From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) by master.gitmailbox.com (Postfix) with ESMTPS id C37E54072D for ; Wed, 22 Dec 2021 15:33:13 +0000 (UTC) Received: by mail-pg1-f174.google.com with SMTP id g2so2397274pgo.9 for ; Wed, 22 Dec 2021 07:33:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=0+jzSEEt5WZFULr+6KdMyp9C+x5eb5PKQowpO7kNugk=; b=bpoOo6uPQ9aWjRW/A/XDtWyKh3z4eLhGqV2/9/lJ5LoBMr1iiSujT+DwJBBPcPBd9L 3qqjfpqVkeNn0Xtg+e6UIvXv0pXTtNyZh69hN0/AFppxRKFXvofZ4em/7d7di8r81qJ7 ZzZliwoZZQrQrdOvu0t73Ea7qE6n32KpsNeRaZPQvuFxCffhMXa+w1R4RbNU/yEpwLva x3xfse4BvsL6W3YBBRvM7QelmudcZfyhjCj0p4k0DBvHXBdf9HtpfYGaUyf7tOXV8KG1 bK92SC7/vkT5IldDCESsZdWiLkbNm+pjBUpnB4EPPMCIAxKLWP0Uu/SnDXsPYMzBgxkJ JVAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=0+jzSEEt5WZFULr+6KdMyp9C+x5eb5PKQowpO7kNugk=; b=EWb6KIFH7StmJ7LK67XmAIcghThlKxXosK/nLMU+U3xUOUvWPri7vOfysY3s1Y4cf9 V18vdLPzDpsn/BLinrdzBSxlSnjXJGGY83qYVduU69Ny3IdIpb6Mo15D4l22slk/Q4un 1c0W2Eokd0HrqDS/M52yUx1YXuh6Jqzjs8edu8ljke0Inji9VlQl3MtVHzTQeC72ERwo yIPKEIr7FM8E744FgtnPUyRKUgNjVzIvRDFsiWF0/0Cvdv0XfxFl5kJYTCbPEcbExRYe 2OnZRhNlbrQWI4Bg3ZIjh4G1ehiRni5yPV4PEe173IMz2xFVdEjIehy0P+wI5UMwT1of G0kg== X-Gm-Message-State: AOAM5305uDginMFpabv3hcvKnrqAHulOIhAfsdc/K2DYkXtW7M/u0kBz /FnZBUKR2wGfZpxXjigdjnyCZUo3byeOIHSx X-Google-Smtp-Source: ABdhPJxneVuFUKexN6wFgr7X/U/Ufzv4Re2rDWJ4Bx9GZdv0mhqGSv2wHoXHAwY2Sw8F2Gsycb/Few== X-Received: by 2002:a62:80c2:0:b0:4bb:47a:6983 with SMTP id j185-20020a6280c2000000b004bb047a6983mr3295082pfd.24.1640183590651; Wed, 22 Dec 2021 06:33:10 -0800 (PST) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id m16sm2899674pfk.32.2021.12.22.06.33.10 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Dec 2021 06:33:10 -0800 (PST) Message-Id: <91d40effc8719180d5ac773d2fc545eb8514b1e1.1640183587.git.ffmpegagent@gmail.com> In-Reply-To: References: From: ffmpegagent Date: Wed, 22 Dec 2021 14:32:58 +0000 Subject: [PATCH 02/11] libavformat/asfdec: fix get_value return type and add checks for Fcc: Sent Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MIME-Version: 1.0 To: ffmpegdev@gitmailbox.com Cc: softworkz , softworkz Archived-At: List-Archive: List-Post: From: softworkz unsupported values get_value had a return type of int, which means that reading QWORDS (case 4) was broken due to truncation of the result from avio_rl64(). Signed-off-by: softworkz --- libavformat/asfdec_f.c | 38 +++++++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index a8f36ed286..d31e1d581d 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -202,7 +202,7 @@ static int asf_probe(const AVProbeData *pd) /* size of type 2 (BOOL) is 32bit for "Extended Content Description Object" * but 16 bit for "Metadata Object" and "Metadata Library Object" */ -static int get_value(AVIOContext *pb, int type, int type2_size) +static uint64_t get_value(AVIOContext *pb, int type, int type2_size) { switch (type) { case ASF_BOOL: @@ -567,10 +567,22 @@ static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) /* My sample has that stream set to 0 maybe that mean the container. * ASF stream count starts at 1. I am using 0 to the container value * since it's unused. */ - if (!strcmp(name, "AspectRatioX")) - asf->dar[0].num = get_value(s->pb, value_type, 32); - else if (!strcmp(name, "AspectRatioY")) - asf->dar[0].den = get_value(s->pb, value_type, 32); + if (!strcmp(name, "AspectRatioX")) { + const uint64_t value = get_value(s->pb, value_type, 32); + if (value > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", value); + return AVERROR(ENOTSUP); + } + asf->dar[0].num = (int)value; + } + else if (!strcmp(name, "AspectRatioY")) { + const uint64_t value = get_value(s->pb, value_type, 32); + if (value > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", value); + return AVERROR(ENOTSUP); + } + asf->dar[0].den = (int)value; + } else get_tag(s, name, value_type, value_len, 32); } @@ -630,13 +642,21 @@ static int asf_read_metadata(AVFormatContext *s, int64_t size) i, stream_num, name_len_utf16, value_type, value_len, name); if (!strcmp(name, "AspectRatioX")){ - int aspect_x = get_value(s->pb, value_type, 16); + const uint64_t aspect_x = get_value(s->pb, value_type, 16); + if (aspect_x > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", aspect_x); + return AVERROR(ENOTSUP); + } if(stream_num < 128) - asf->dar[stream_num].num = aspect_x; + asf->dar[stream_num].num = (int)aspect_x; } else if(!strcmp(name, "AspectRatioY")){ - int aspect_y = get_value(s->pb, value_type, 16); + const uint64_t aspect_y = get_value(s->pb, value_type, 16); + if (aspect_y > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", aspect_y); + return AVERROR(ENOTSUP); + } if(stream_num < 128) - asf->dar[stream_num].den = aspect_y; + asf->dar[stream_num].den = (int)aspect_y; } else { get_tag(s, name, value_type, value_len, 16); } -- gitgitgadget