Re: [FFmpeg-devel] [PATCH 1/2] avcodec/flac_parser: Assert that we do not overrun the link_penalty array - Rémi Denis-Courmont

From: "Rémi Denis-Courmont" <remi@remlab.net>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: Re: [FFmpeg-devel] [PATCH 1/2] avcodec/flac_parser: Assert that we do not overrun the link_penalty array
Date: Mon, 13 May 2024 09:07:50 +0300
Message-ID: <A5A94449-9A9E-4DE7-A721-E18ED73E6538@remlab.net> (raw)
In-Reply-To: <20240504235200.2875183-1-michael@niedermayer.cc>

Le 5 mai 2024 02:51:59 GMT+03:00, Michael Niedermayer <michael@niedermayer.cc> a écrit :
>Fixes: CID1454676 Out-of-bounds read

It's a stretch to call this "fixing". It just asserts that the situation doesn't happen, in other words, that it is a false positive from the static analyser.

The code change looks OK, but the commit description seems misleading.

>
>Sponsored-by: Sovereign Tech Fund
>Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>---
> libavcodec/flac_parser.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/libavcodec/flac_parser.c b/libavcodec/flac_parser.c
>index 47904d515a6..d9c47801f83 100644
>--- a/libavcodec/flac_parser.c
>+++ b/libavcodec/flac_parser.c
>@@ -518,6 +518,8 @@ static int check_header_mismatch(FLACParseContext  *fpc,
>         for (i = 0; i < FLAC_MAX_SEQUENTIAL_HEADERS && curr != child; i++)
>             curr = curr->next;
> 
>+        av_assert0(i < FLAC_MAX_SEQUENTIAL_HEADERS);
>+
>         if (header->link_penalty[i] < FLAC_HEADER_CRC_FAIL_PENALTY ||
>             header->link_penalty[i] == FLAC_HEADER_NOT_PENALIZED_YET) {
>             FLACHeaderMarker *start, *end;
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".