From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 404B84575B for ; Mon, 14 Jul 2025 20:00:29 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id CF19568EE60; Mon, 14 Jul 2025 23:00:25 +0300 (EEST) Received: from btbn.de (btbn.de [144.76.60.213]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id C191B68EB07 for ; Mon, 14 Jul 2025 23:00:19 +0300 (EEST) Received: from [authenticated] by btbn.de (Postfix) with ESMTPSA id A32A32819122E for ; Mon, 14 Jul 2025 22:00:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rothenpieler.org; s=mail; t=1752523218; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Se4L6eaw3g5ORuZjRIpnXq2ESf5+9r1+yuoBKSagRlU=; b=HyN79KkDSaU2KAu3sY/vxno+V/GfJ/H188+tDJYSj4aktKMTB/ZlCNGhaSIWU8tz5GAzAR DsyvVVtHSuCDGn0ELP5BILvbsOXgsc9pC+1eq+W5nOXsA5vLF5myw4Brh26yyYSOicB/79 qe/AKtc4D7rkFLG3F9s4J57ltBA9hiOKmt3Zwxc0gezHJpTeeYSgdcAbbipKvBdLUhC0hJ zrAfs9YBPbfpmM+GGv4Waj5x3TTtlrrK9/pG9abfVf7Zfto2epjeinsy7aehP/cTWMnirr gW0kgPmiOYeeZQQ50Jt8AsF1RcVy8MfIvm/WpgEAnYYvhk5r8hkgE7rSTOes7g== Content-Type: multipart/mixed; boundary="------------x61FQ03cLD0hfMjePsX8rxHc" Message-ID: <71ce56e6-5d83-41f7-9872-e81e0a342cf9@rothenpieler.org> Date: Mon, 14 Jul 2025 22:00:19 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: ffmpeg-devel@ffmpeg.org References: <20250713011030.1156550-1-michael@niedermayer.cc> <20250714192133.GL29660@pb2> Content-Language: en-US From: Timo Rothenpieler In-Reply-To: <20250714192133.GL29660@pb2> Subject: Re: [FFmpeg-devel] [PATCH 1/5] avformat/flvdec: Check for EOF in AudioPacketTypeMultichannelConfig X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: This is a multi-part message in MIME format. --------------x61FQ03cLD0hfMjePsX8rxHc Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 7/14/2025 9:21 PM, Michael Niedermayer wrote: > On Sun, Jul 13, 2025 at 01:42:28PM +0200, Timo Rothenpieler wrote: >> On 7/13/2025 3:10 AM, Michael Niedermayer wrote: >>> Fixes: Infinite loop >>> Fixes: 427538726/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-6582567304495104 >>> >>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg >>> Signed-off-by: Michael Niedermayer >>> --- >>> libavformat/flvdec.c | 3 +++ >>> 1 file changed, 3 insertions(+) >>> >>> diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c >>> index ac681954cb7..a4fa0157512 100644 >>> --- a/libavformat/flvdec.c >>> +++ b/libavformat/flvdec.c >>> @@ -1715,6 +1715,9 @@ retry_duration: >>> av_log(s, AV_LOG_DEBUG, "Set channel data from MultiChannel info.\n"); >>> + if (avio_feof(s->pb)) >>> + return AVERROR_EOF; >>> + >>> goto next_track; >>> } >>> } else if (stream_type == FLV_STREAM_TYPE_VIDEO) { >> >> I don't think just returning from here is correct. >> The goto next_track right after it already checks for EOF. > >> I do not see how between here and the eof check there there'd be any way to >> infinite loop. > > avio_skip() with a negative value will reset the EOF flag > > >> >> It returns FFERROR_REDO there, which is important to drain queued up >> packages. > > I think the state becomes corrupted once it reads into EOF > that is the size accounting goes "oops" as the code keeps running > things that read and keeps accounting for these reads but in reality > nothing is read as its at EOF > and then it seeks back all these "not reads" and thats where it hits the > infinite loop as theres a mismatch what the code thinks it moved forward > and what it actually moved forward. > Thats how it looked to me at least, i have not verified every step of this > > ill mail you the testcase, then you can check if my analysis is right > and fix the code in a way that can recover queued packets in such truncated > packet at EOF case. > Also please make sure its not forgotten that whatever fix this gets is backported I'm unable to reproduce any infinite loops, even with the sample. But the code there definitely is sub-optimal, given the seek can go the wrong way, and even when going the right way can potentially reset the EOF flag. Proposed patch is attached. --------------x61FQ03cLD0hfMjePsX8rxHc Content-Type: text/plain; charset=UTF-8; name="0001-avformat-flvdec-don-t-skip-backwards-or-at-EOF.patch" Content-Disposition: attachment; filename*0="0001-avformat-flvdec-don-t-skip-backwards-or-at-EOF.patch" Content-Transfer-Encoding: base64 RnJvbSA3ZmYzOTRlMWVjYWI1MDRhNGNiMGZkYTRiZDBmMjVkODhlZTRmNmZlIE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBUaW1vIFJvdGhlbnBpZWxlciA8dGltb0Byb3RoZW5w aWVsZXIub3JnPgpEYXRlOiBNb24sIDE0IEp1bCAyMDI1IDIxOjU0OjM1ICswMjAwClN1Ympl Y3Q6IFtQQVRDSF0gYXZmb3JtYXQvZmx2ZGVjOiBkb24ndCBza2lwIGJhY2t3YXJkcyBvciBh dCBFT0YKCi0tLQogbGliYXZmb3JtYXQvZmx2ZGVjLmMgfCAxMiArKysrKysrKysrLS0KIDEg ZmlsZSBjaGFuZ2VkLCAxMCBpbnNlcnRpb25zKCspLCAyIGRlbGV0aW9ucygtKQoKZGlmZiAt LWdpdCBhL2xpYmF2Zm9ybWF0L2ZsdmRlYy5jIGIvbGliYXZmb3JtYXQvZmx2ZGVjLmMKaW5k ZXggYjkwZWQzNGIxYy4uZGU1ZTY4ODgyMiAxMDA2NDQKLS0tIGEvbGliYXZmb3JtYXQvZmx2 ZGVjLmMKKysrIGIvbGliYXZmb3JtYXQvZmx2ZGVjLmMKQEAgLTE4NjAsOCArMTg2MCwxNiBA QCByZXRyeV9kdXJhdGlvbjoKIG5leHRfdHJhY2s6CiAgICAgICAgIGlmICh0cmFja19zaXpl KSB7CiAgICAgICAgICAgICBhdl9sb2cocywgQVZfTE9HX1dBUk5JTkcsICJUcmFjayBzaXpl IG1pc21hdGNoOiAlZCFcbiIsIHRyYWNrX3NpemUpOwotICAgICAgICAgICAgYXZpb19za2lw KHMtPnBiLCB0cmFja19zaXplKTsKLSAgICAgICAgICAgIHNpemUgLT0gdHJhY2tfc2l6ZTsK KyAgICAgICAgICAgIGlmICghYXZpb19mZW9mKHMtPnBiKSkgeworICAgICAgICAgICAgICAg IGlmICh0cmFja19zaXplID4gMCkgeworICAgICAgICAgICAgICAgICAgICBhdmlvX3NraXAo cy0+cGIsIHRyYWNrX3NpemUpOworICAgICAgICAgICAgICAgICAgICBzaXplIC09IHRyYWNr X3NpemU7CisgICAgICAgICAgICAgICAgfSBlbHNlIHsKKyAgICAgICAgICAgICAgICAgICAg LyogV2UgaGF2ZSBzb21laG93IHJlYWQgbW9yZSB0aGFuIHRoZSB0cmFjayBoYWQgdG8gb2Zm ZXIsIGxlYXZlIGFuZCByZS1zeW5jICovCisgICAgICAgICAgICAgICAgICAgIHJldCA9IEZG RVJST1JfUkVETzsKKyAgICAgICAgICAgICAgICAgICAgZ290byBsZWF2ZTsKKyAgICAgICAg ICAgICAgICB9CisgICAgICAgICAgICB9CiAgICAgICAgIH0KIAogICAgICAgICBpZiAoIXNp emUpCi0tIAoyLjQ5LjAKCg== --------------x61FQ03cLD0hfMjePsX8rxHc Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --------------x61FQ03cLD0hfMjePsX8rxHc--