* [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
@ 2022-12-24 22:50 Michael Niedermayer
2022-12-26 10:32 ` Tomas Härdin
0 siblings, 1 reply; 13+ messages in thread
From: Michael Niedermayer @ 2022-12-24 22:50 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Fixes: OOM
Fixes: 50551/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6607795234930688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mxfdec.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 0553728253..64ac6a44b8 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1943,6 +1943,10 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta
}
index_table->nb_ptses += s->index_duration;
+ // If index_duration is substantially larger than nb_index_entries then this algorithm which
+ // allocates index_duration elements is a bad idea. All files i tried have it equal
+ if (s->index_duration > 10LL * s->nb_index_entries)
+ return AVERROR_PATCHWELCOME;
}
/* paranoid check */
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
2022-12-24 22:50 [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration Michael Niedermayer
@ 2022-12-26 10:32 ` Tomas Härdin
2022-12-26 21:54 ` Michael Niedermayer
0 siblings, 1 reply; 13+ messages in thread
From: Tomas Härdin @ 2022-12-26 10:32 UTC (permalink / raw)
To: FFmpeg development discussions and patches
lör 2022-12-24 klockan 23:50 +0100 skrev Michael Niedermayer:
>
> index_table->nb_ptses += s->index_duration;
> + // If index_duration is substantially larger than
> nb_index_entries then this algorithm which
> + // allocates index_duration elements is a bad idea. All
> files i tried have it equal
> + if (s->index_duration > 10LL * s->nb_index_entries)
> + return AVERROR_PATCHWELCOME;
I was going to say this can overflow but the 10LL ensures it can't. So
looks OK.
/Tomas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
2022-12-26 10:32 ` Tomas Härdin
@ 2022-12-26 21:54 ` Michael Niedermayer
2022-12-27 18:05 ` Marton Balint
0 siblings, 1 reply; 13+ messages in thread
From: Michael Niedermayer @ 2022-12-26 21:54 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 969 bytes --]
On Mon, Dec 26, 2022 at 11:32:48AM +0100, Tomas Härdin wrote:
> lör 2022-12-24 klockan 23:50 +0100 skrev Michael Niedermayer:
> >
> > index_table->nb_ptses += s->index_duration;
> > + // If index_duration is substantially larger than
> > nb_index_entries then this algorithm which
> > + // allocates index_duration elements is a bad idea. All
> > files i tried have it equal
> > + if (s->index_duration > 10LL * s->nb_index_entries)
> > + return AVERROR_PATCHWELCOME;
>
> I was going to say this can overflow but the 10LL ensures it can't. So
> looks OK.
will apply
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
The real ebay dictionary, page 1
"Used only once" - "Some unspecified defect prevented a second use"
"In good condition" - "Can be repaird by experienced expert"
"As is" - "You wouldnt want it even if you were payed for it, if you knew ..."
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
2022-12-26 21:54 ` Michael Niedermayer
@ 2022-12-27 18:05 ` Marton Balint
2022-12-27 21:49 ` Michael Niedermayer
0 siblings, 1 reply; 13+ messages in thread
From: Marton Balint @ 2022-12-27 18:05 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On Mon, 26 Dec 2022, Michael Niedermayer wrote:
> On Mon, Dec 26, 2022 at 11:32:48AM +0100, Tomas Härdin wrote:
>> lör 2022-12-24 klockan 23:50 +0100 skrev Michael Niedermayer:
>>>
>>> index_table->nb_ptses += s->index_duration;
>>> + // If index_duration is substantially larger than
>>> nb_index_entries then this algorithm which
>>> + // allocates index_duration elements is a bad idea. All
>>> files i tried have it equal
>>> + if (s->index_duration > 10LL * s->nb_index_entries)
>>> + return AVERROR_PATCHWELCOME;
>>
>> I was going to say this can overflow but the 10LL ensures it can't. So
>> looks OK.
>
> will apply
Please don't, as far as I see this disallows the usage of partial index
tables, so practically rejecting valid files, which is not OK.
Regards,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
2022-12-27 18:05 ` Marton Balint
@ 2022-12-27 21:49 ` Michael Niedermayer
2022-12-27 22:32 ` Marton Balint
2022-12-27 22:35 ` Tomas Härdin
0 siblings, 2 replies; 13+ messages in thread
From: Michael Niedermayer @ 2022-12-27 21:49 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 1378 bytes --]
On Tue, Dec 27, 2022 at 07:05:44PM +0100, Marton Balint wrote:
>
>
> On Mon, 26 Dec 2022, Michael Niedermayer wrote:
>
> > On Mon, Dec 26, 2022 at 11:32:48AM +0100, Tomas Härdin wrote:
> > > lör 2022-12-24 klockan 23:50 +0100 skrev Michael Niedermayer:
> > > >
> > > > index_table->nb_ptses += s->index_duration;
> > > > + // If index_duration is substantially larger than
> > > > nb_index_entries then this algorithm which
> > > > + // allocates index_duration elements is a bad idea. All
> > > > files i tried have it equal
> > > > + if (s->index_duration > 10LL * s->nb_index_entries)
> > > > + return AVERROR_PATCHWELCOME;
> > >
> > > I was going to say this can overflow but the 10LL ensures it can't. So
> > > looks OK.
> >
> > will apply
>
> Please don't, as far as I see this disallows the usage of partial index
> tables, so practically rejecting valid files, which is not OK.
can you share a file that would break ?
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
If you drop bombs on a foreign country and kill a hundred thousand
innocent people, expect your government to call the consequence
"unprovoked inhuman terrorist attacks" and use it to justify dropping
more bombs and killing more people. The technology changed, the idea is old.
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
2022-12-27 21:49 ` Michael Niedermayer
@ 2022-12-27 22:32 ` Marton Balint
2022-12-28 2:26 ` Marton Balint
2022-12-27 22:35 ` Tomas Härdin
1 sibling, 1 reply; 13+ messages in thread
From: Marton Balint @ 2022-12-27 22:32 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On Tue, 27 Dec 2022, Michael Niedermayer wrote:
> On Tue, Dec 27, 2022 at 07:05:44PM +0100, Marton Balint wrote:
>>
>>
>> On Mon, 26 Dec 2022, Michael Niedermayer wrote:
>>
>>> On Mon, Dec 26, 2022 at 11:32:48AM +0100, Tomas Härdin wrote:
>>>> lör 2022-12-24 klockan 23:50 +0100 skrev Michael Niedermayer:
>>>>>
>>>>> index_table->nb_ptses += s->index_duration;
>>>>> + // If index_duration is substantially larger than
>>>>> nb_index_entries then this algorithm which
>>>>> + // allocates index_duration elements is a bad idea. All
>>>>> files i tried have it equal
>>>>> + if (s->index_duration > 10LL * s->nb_index_entries)
>>>>> + return AVERROR_PATCHWELCOME;
>>>>
>>>> I was going to say this can overflow but the 10LL ensures it can't. So
>>>> looks OK.
>>>
>>> will apply
>>
>> Please don't, as far as I see this disallows the usage of partial index
>> tables, so practically rejecting valid files, which is not OK.
>
> can you share a file that would break ?
I don't have such file. But the MXF specs (SMPTE 377-1-2009) explictly
defines the concept of partial index tables:
"Where all Index Table segments are contiguous, or there is only one
segment, but not all Edit Units in the Essence Container are indexed,
these tables are called Partial Index Tables."
As far as I see here nb_index_entries is corresponding to the number of
indexed edit units, and the number is allowed to be smaller than the index
duration, because not all edit units have to be indexed.
Regards,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
2022-12-27 21:49 ` Michael Niedermayer
2022-12-27 22:32 ` Marton Balint
@ 2022-12-27 22:35 ` Tomas Härdin
1 sibling, 0 replies; 13+ messages in thread
From: Tomas Härdin @ 2022-12-27 22:35 UTC (permalink / raw)
To: FFmpeg development discussions and patches
tis 2022-12-27 klockan 22:49 +0100 skrev Michael Niedermayer:
> On Tue, Dec 27, 2022 at 07:05:44PM +0100, Marton Balint wrote:
> >
> >
> > On Mon, 26 Dec 2022, Michael Niedermayer wrote:
> >
> > > On Mon, Dec 26, 2022 at 11:32:48AM +0100, Tomas Härdin wrote:
> > > > lör 2022-12-24 klockan 23:50 +0100 skrev Michael Niedermayer:
> > > > >
> > > > > index_table->nb_ptses += s->index_duration;
> > > > > + // If index_duration is substantially larger than
> > > > > nb_index_entries then this algorithm which
> > > > > + // allocates index_duration elements is a bad idea.
> > > > > All
> > > > > files i tried have it equal
> > > > > + if (s->index_duration > 10LL * s->nb_index_entries)
> > > > > + return AVERROR_PATCHWELCOME;
> > > >
> > > > I was going to say this can overflow but the 10LL ensures it
> > > > can't. So
> > > > looks OK.
> > >
> > > will apply
> >
> > Please don't, as far as I see this disallows the usage of partial
> > index
> > tables, so practically rejecting valid files, which is not OK.
Damn, not sure how I missed that. The use of the magic constant 10
should have tipped me off.
>
> can you share a file that would break ?
mxfenc will produce files like that. It's actually a major deficiency
with the muxer since it produces excessive amounts of partitions.
/Tomas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
2022-12-27 22:32 ` Marton Balint
@ 2022-12-28 2:26 ` Marton Balint
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 1/3] avformat/mxfdec: check index entry array size Marton Balint
2023-01-22 0:05 ` [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration Marton Balint
0 siblings, 2 replies; 13+ messages in thread
From: Marton Balint @ 2022-12-28 2:26 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On Tue, 27 Dec 2022, Marton Balint wrote:
>
>
> On Tue, 27 Dec 2022, Michael Niedermayer wrote:
>
>> On Tue, Dec 27, 2022 at 07:05:44PM +0100, Marton Balint wrote:
>>>
>>>
>>> On Mon, 26 Dec 2022, Michael Niedermayer wrote:
>>>
>>>> On Mon, Dec 26, 2022 at 11:32:48AM +0100, Tomas Härdin wrote:
>>>>> lör 2022-12-24 klockan 23:50 +0100 skrev Michael Niedermayer:
>>>>>>
>>>>>> index_table->nb_ptses += s->index_duration;
>>>>>> + // If index_duration is substantially larger than
>>>>>> nb_index_entries then this algorithm which
>>>>>> + // allocates index_duration elements is a bad idea. All
>>>>>> files i tried have it equal
>>>>>> + if (s->index_duration > 10LL * s->nb_index_entries)
>>>>>> + return AVERROR_PATCHWELCOME;
>>>>>
>>>>> I was going to say this can overflow but the 10LL ensures it can't. So
>>>>> looks OK.
>>>>
>>>> will apply
>>>
>>> Please don't, as far as I see this disallows the usage of partial index
>>> tables, so practically rejecting valid files, which is not OK.
>>
>> can you share a file that would break ?
>
> I don't have such file. But the MXF specs (SMPTE 377-1-2009) explictly
> defines the concept of partial index tables:
>
> "Where all Index Table segments are contiguous, or there is only one segment,
> but not all Edit Units in the Essence Container are indexed, these tables are
> called Partial Index Tables."
>
> As far as I see here nb_index_entries is corresponding to the number of
> indexed edit units, and the number is allowed to be smaller than the index
> duration, because not all edit units have to be indexed.
I read the specs again, and it seems that I misread it the first time,
because partial index tables mean that the index segments have no gaps
between them, but the index still not cover the whole essence. So it is
not referring to the index entries in the segment.
So, in principal your patch *might* be OK. However, existing code simply
ignores a corrupt index table, does not reject it. I kind of prefer we
make the check more strict, but gracefully allow corrupted index by
ignoring it fully.
I will post a follow up patch series.
Regards,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* [FFmpeg-devel] [PATCH 1/3] avformat/mxfdec: check index entry array size
2022-12-28 2:26 ` Marton Balint
@ 2022-12-28 3:19 ` Marton Balint
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 2/3] avformat/mxfdec: support Avid files with an extra index entry Marton Balint
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 3/3] avformat/mxfdec: check number of index table entires more strictly Marton Balint
2023-01-22 0:05 ` [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration Marton Balint
1 sibling, 2 replies; 13+ messages in thread
From: Marton Balint @ 2022-12-28 3:19 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Marton Balint
Signed-off-by: Marton Balint <cus@passwd.hu>
---
libavformat/mxfdec.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index e6118e141d..ad4ee15570 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1198,11 +1198,15 @@ static int mxf_read_essence_container_data(void *arg, AVIOContext *pb, int tag,
static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *segment)
{
int i, length;
+ uint32_t nb_index_entries;
if (segment->temporal_offset_entries)
return AVERROR_INVALIDDATA;
- segment->nb_index_entries = avio_rb32(pb);
+ nb_index_entries = avio_rb32(pb);
+ if (nb_index_entries > INT_MAX)
+ return AVERROR_INVALIDDATA;
+ segment->nb_index_entries = nb_index_entries;
length = avio_rb32(pb);
if(segment->nb_index_entries && length < 11)
--
2.35.3
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* [FFmpeg-devel] [PATCH 2/3] avformat/mxfdec: support Avid files with an extra index entry
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 1/3] avformat/mxfdec: check index entry array size Marton Balint
@ 2022-12-28 3:19 ` Marton Balint
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 3/3] avformat/mxfdec: check number of index table entires more strictly Marton Balint
1 sibling, 0 replies; 13+ messages in thread
From: Marton Balint @ 2022-12-28 3:19 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Marton Balint
Signed-off-by: Marton Balint <cus@passwd.hu>
---
libavformat/mxfdec.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index ad4ee15570..2e61e77d67 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1991,11 +1991,11 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta
int index_delta = 1;
int n = s->nb_index_entries;
- if (s->nb_index_entries == 2 * s->index_duration + 1) {
+ if (s->nb_index_entries == 2 * s->index_duration + 1)
index_delta = 2; /* Avid index */
- /* ignore the last entry - it's the size of the essence container */
+ if (s->nb_index_entries == index_delta * s->index_duration + 1)
+ /* ignore the last entry - it's the size of the essence container in Avid */
n--;
- }
for (j = 0; j < n; j += index_delta, x++) {
int offset = s->temporal_offset_entries[j] / index_delta;
--
2.35.3
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* [FFmpeg-devel] [PATCH 3/3] avformat/mxfdec: check number of index table entires more strictly
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 1/3] avformat/mxfdec: check index entry array size Marton Balint
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 2/3] avformat/mxfdec: support Avid files with an extra index entry Marton Balint
@ 2022-12-28 3:19 ` Marton Balint
1 sibling, 0 replies; 13+ messages in thread
From: Marton Balint @ 2022-12-28 3:19 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Marton Balint
Let's ignore the index table if the number of index entries does not match the
index duration (or the special AVID index entry counts).
Fixes: OOM
Fixes: 50551/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6607795234930688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Marton Balint <cus@passwd.hu>
---
libavformat/mxfdec.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 2e61e77d67..0dc61648b1 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1937,6 +1937,14 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta
return 0;
}
+ if (s->nb_index_entries != s->index_duration &&
+ s->nb_index_entries != s->index_duration + 1 &&
+ s->nb_index_entries != s->index_duration * 2 + 1) {
+ index_table->nb_ptses = 0;
+ av_log(mxf->fc, AV_LOG_ERROR, "ignoring IndexSID %d, duration does not match nb_index_entries\n", s->index_sid);
+ return 0;
+ }
+
index_table->nb_ptses += s->index_duration;
}
--
2.35.3
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
2022-12-28 2:26 ` Marton Balint
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 1/3] avformat/mxfdec: check index entry array size Marton Balint
@ 2023-01-22 0:05 ` Marton Balint
2023-01-29 11:15 ` Marton Balint
1 sibling, 1 reply; 13+ messages in thread
From: Marton Balint @ 2023-01-22 0:05 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On Wed, 28 Dec 2022, Marton Balint wrote:
>
>
> On Tue, 27 Dec 2022, Marton Balint wrote:
>
>>
>>
>> On Tue, 27 Dec 2022, Michael Niedermayer wrote:
>>
>>> On Tue, Dec 27, 2022 at 07:05:44PM +0100, Marton Balint wrote:
>>>>
>>>>
>>>> On Mon, 26 Dec 2022, Michael Niedermayer wrote:
>>>>
>>>>> On Mon, Dec 26, 2022 at 11:32:48AM +0100, Tomas Härdin wrote:
>>>>>> lör 2022-12-24 klockan 23:50 +0100 skrev Michael Niedermayer:
>>>>>>>
>>>>>>> index_table->nb_ptses += s->index_duration;
>>>>>>> + // If index_duration is substantially larger than
>>>>>>> nb_index_entries then this algorithm which
>>>>>>> + // allocates index_duration elements is a bad idea. All
>>>>>>> files i tried have it equal
>>>>>>> + if (s->index_duration > 10LL * s->nb_index_entries)
>>>>>>> + return AVERROR_PATCHWELCOME;
>>>>>>
>>>>>> I was going to say this can overflow but the 10LL ensures it can't.
>>>>>> So
>>>>>> looks OK.
>>>>>
>>>>> will apply
>>>>
>>>> Please don't, as far as I see this disallows the usage of partial index
>>>> tables, so practically rejecting valid files, which is not OK.
>>>
>>> can you share a file that would break ?
>>
>> I don't have such file. But the MXF specs (SMPTE 377-1-2009) explictly
>> defines the concept of partial index tables:
>>
>> "Where all Index Table segments are contiguous, or there is only one
>> segment, but not all Edit Units in the Essence Container are indexed,
>> these tables are called Partial Index Tables."
>>
>> As far as I see here nb_index_entries is corresponding to the number of
>> indexed edit units, and the number is allowed to be smaller than the index
>> duration, because not all edit units have to be indexed.
>
> I read the specs again, and it seems that I misread it the first time,
> because partial index tables mean that the index segments have no gaps
> between them, but the index still not cover the whole essence. So it is not
> referring to the index entries in the segment.
>
> So, in principal your patch *might* be OK. However, existing code simply
> ignores a corrupt index table, does not reject it. I kind of prefer we make
> the check more strict, but gracefully allow corrupted index by ignoring it
> fully.
>
> I will post a follow up patch series.
Ping for the series I posted.
Thanks,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration
2023-01-22 0:05 ` [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration Marton Balint
@ 2023-01-29 11:15 ` Marton Balint
0 siblings, 0 replies; 13+ messages in thread
From: Marton Balint @ 2023-01-29 11:15 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On Sun, 22 Jan 2023, Marton Balint wrote:
>
>
> On Wed, 28 Dec 2022, Marton Balint wrote:
>
>>
>>
>> On Tue, 27 Dec 2022, Marton Balint wrote:
>>
>>>
>>>
>>> On Tue, 27 Dec 2022, Michael Niedermayer wrote:
>>>
>>>> On Tue, Dec 27, 2022 at 07:05:44PM +0100, Marton Balint wrote:
>>>>>
>>>>>
>>>>> On Mon, 26 Dec 2022, Michael Niedermayer wrote:
>>>>>
>>>>>> On Mon, Dec 26, 2022 at 11:32:48AM +0100, Tomas Härdin wrote:
>>>>>>> lör 2022-12-24 klockan 23:50 +0100 skrev Michael Niedermayer:
>>>>>>>>
>>>>>>>> index_table->nb_ptses += s->index_duration;
>>>>>>>> + // If index_duration is substantially larger than
>>>>>>>> nb_index_entries then this algorithm which
>>>>>>>> + // allocates index_duration elements is a bad idea. All
>>>>>>>> files i tried have it equal
>>>>>>>> + if (s->index_duration > 10LL * s->nb_index_entries)
>>>>>>>> + return AVERROR_PATCHWELCOME;
>>>>>>>
>>>>>>> I was going to say this can overflow but the 10LL ensures it can't.
>>>>>>> So
>>>>>>> looks OK.
>>>>>>
>>>>>> will apply
>>>>>
>>>>> Please don't, as far as I see this disallows the usage of partial
>>>>> index
>>>>> tables, so practically rejecting valid files, which is not OK.
>>>>
>>>> can you share a file that would break ?
>>>
>>> I don't have such file. But the MXF specs (SMPTE 377-1-2009) explictly
>>> defines the concept of partial index tables:
>>>
>>> "Where all Index Table segments are contiguous, or there is only one
>>> segment, but not all Edit Units in the Essence Container are indexed,
>>> these tables are called Partial Index Tables."
>>>
>>> As far as I see here nb_index_entries is corresponding to the number of
>>> indexed edit units, and the number is allowed to be smaller than the
>>> index
>>> duration, because not all edit units have to be indexed.
>>
>> I read the specs again, and it seems that I misread it the first time,
>> because partial index tables mean that the index segments have no gaps
>> between them, but the index still not cover the whole essence. So it is
>> not referring to the index entries in the segment.
>>
>> So, in principal your patch *might* be OK. However, existing code simply
>> ignores a corrupt index table, does not reject it. I kind of prefer we
>> make the check more strict, but gracefully allow corrupted index by
>> ignoring it fully.
>>
>> I will post a follow up patch series.
>
> Ping for the series I posted.
Will apply.
Regards,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2023-01-29 11:15 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-24 22:50 [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration Michael Niedermayer
2022-12-26 10:32 ` Tomas Härdin
2022-12-26 21:54 ` Michael Niedermayer
2022-12-27 18:05 ` Marton Balint
2022-12-27 21:49 ` Michael Niedermayer
2022-12-27 22:32 ` Marton Balint
2022-12-28 2:26 ` Marton Balint
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 1/3] avformat/mxfdec: check index entry array size Marton Balint
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 2/3] avformat/mxfdec: support Avid files with an extra index entry Marton Balint
2022-12-28 3:19 ` [FFmpeg-devel] [PATCH 3/3] avformat/mxfdec: check number of index table entires more strictly Marton Balint
2023-01-22 0:05 ` [FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration Marton Balint
2023-01-29 11:15 ` Marton Balint
2022-12-27 22:35 ` Tomas Härdin
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git