From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 6F12E46404 for ; Fri, 16 Jun 2023 18:59:49 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id B051E68C195; Fri, 16 Jun 2023 21:59:46 +0300 (EEST) Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05olkn2049.outbound.protection.outlook.com [40.92.91.49]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 0844468BBC9 for ; Fri, 16 Jun 2023 21:59:39 +0300 (EEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Xv7bsq6s8Z8bSvZnXQ4ZnHaKf4ln33ylZHn7xpqhp0DcpIJdVnRbhKp1qELMhDwO3GJls6nOqqblJj+0293VoRECUuHQojWUwq3xR4oGGYksE3nNua80ubBXGU/NbmUOWuEJLy/5dGECZvEBq4FoTGrqViOtEWSHb9hOD76fw7ads6QpGY/Rrwxh9XPaCBVFzqrs7qRuPU5PBFHFidmgr9kjJXQjDNo84zW5r+zTc2MbpUxNkm4Fi1pU2PBnTTWRJ9LjZtJii7i1tVzjEhc3qcgfXZnEW/oniRbr8mTqL5/yalBvpvSZ+NU3aHPWE8ru+bsqGbTmU/8tm5uCm+7p2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5w33YS93yLdQv2YmEC8D8mmEeUybQf13Gri7XF6h8Kg=; b=PugoJCu5h6T21JFRJ2kMqdT0EbFO2vUbzDdd4JkjV8bQfvNbC/QMezNZjvzag+K+g3O2wSMfP3FAciWkWWoctz5WaiunS1dsmW34a/CP0JhMU7BO3r97Jjm39ntXdB5agek76znv6cHRZbL0u4/WKQbcLzzMP8Fzh1U5XrXdNENhZjMcfGWAriUp6KbK36ktb9FR90grB30/tzXQr6mfUKSR/W78Wn1Xf9Ia5wGtDVpNwZsfSVgJEzcWPA/IZzgAbwHImwt71aZzvy3p7dnzBwRCbSEgiGaXfymQ/vTbnD4T3o1JVhR1AhtT/6dO/3/LSuOSIar1o1cMHysQURBpFg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5w33YS93yLdQv2YmEC8D8mmEeUybQf13Gri7XF6h8Kg=; b=hGadPb11wWSWQvr8/I3GRq4b9AIviqdlywVlcw8k/Xyk5nF8eDRXGk6Glq5ZFI+MmzhSa/Iv+WrHCQLD03xlAqg18C5N/9XN2ynBjvuFxHcnUlq6ANVftSVCS4FrY/Xtg+YudZdxMTMCzNGfm2wGUWNNYeTBsRYxh0vYg9PIpSIdJ1oGGCkhITEH5IG+NMnxysL+4FaAtIhARgf6QkKnOKEKZnyC5epDFw+Fet/zjiCUzMStM1f/+YKXx9JNQp+0qni2mqsJYQ0WgrXRX/ofh0Yl3KdU1ZFpNc12Jp2GHpSblTj+TUNMgnPoHcHZZPQrrTmeEUDkYrj5hAKz+tJHSw== Received: from AS8P250MB0744.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:541::14) by PR3P250MB0243.EURP250.PROD.OUTLOOK.COM (2603:10a6:102:17e::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6477.29; Fri, 16 Jun 2023 18:59:38 +0000 Received: from AS8P250MB0744.EURP250.PROD.OUTLOOK.COM ([fe80::a38:e93f:c7e0:f473]) by AS8P250MB0744.EURP250.PROD.OUTLOOK.COM ([fe80::a38:e93f:c7e0:f473%7]) with mapi id 15.20.6477.037; Fri, 16 Jun 2023 18:59:38 +0000 Message-ID: Date: Fri, 16 Jun 2023 21:00:27 +0200 Content-Language: en-US To: ffmpeg-devel@ffmpeg.org References: <20230612132256.84549-1-leo.izen@gmail.com> From: Andreas Rheinhardt In-Reply-To: <20230612132256.84549-1-leo.izen@gmail.com> X-TMN: [haEwKZl68dsH6GBHR/cG2rM9JfMkLjSw] X-ClientProxiedBy: ZR2P278CA0041.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:47::10) To AS8P250MB0744.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:541::14) X-Microsoft-Original-Message-ID: MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P250MB0744:EE_|PR3P250MB0243:EE_ X-MS-Office365-Filtering-Correlation-Id: 893c9c62-1bcc-4bb2-0d16-08db6e9bd551 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: oyf5ICP2P9Muh+WQS0/1pDMBArLaNdEb0NOcBntA04D4IrnsopvLeWZ5fw9fu+Q3oXQzRXVkid4uWY9d3DQQMw9VLEJymvemcs8sCC/WB65UycasBpqOzViFOiplIsfEeNQEJSkvYlspSn3qtGhGqRyjG3R3atYROvUcgjAV43tgVVset+0N8fmk/pn8Vm/yA38oYnT53WYxNsKm75hnXvGfvkA0ajScM3pylZLZXfcMQo56tugE1OERBP9ZHhTPw5mVWHp2gf3FfASjN+/5MMtWbJqxGQ3LD1Ks8GkdbkGNlDlIPTTJK2jSzvj6u7QmxWchmy0QufJZo3bGPcK28DXEqVnSEY89mSRlye7cA3qWzG0vaLQ04rvvnZ0kTZHXp2qF/dIOBaPlAWFu/Iq16q/Y2aQG/daYmEx83+OzaIGC7MSp1PLg/7ktOcx52kDSMrEu03sX/1Ef04JU8Z3K0yovF4L0YhlQ8eE5P9LiapNF4O5Tu+N+ZCkgwdUXcQZxmd5R4IJwddv17/WoBVEmV7Naelf33uttSJzIkaYua7F9he9bIrIzoV6XFPJRy6XwnkaGQImRlOOWRiX1LUVoEgaDGC/wL4unC4xdSkhdcLef+H6D/4SlFpbkSekjAc42 X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TjhqRkdRZnI3VTNDSjhzendXb0JHV0FNMGQrN1p4ellBZzhoVEUwUUVzVWpQ?= =?utf-8?B?UVU5OFhOdFlNd3RNMGduTW1NeGJISjEwMmxNaitXNTJIbHAwM2dGdmNBcmxZ?= =?utf-8?B?cU5nbDJYTUFZQjVvUyt6VWhaT3h6ZDYzMUhPQjlTSUNDZTFaUUVRYUt4V2RB?= =?utf-8?B?NThWYS9XUHppdElmL3NoQ09BaVA0Z0RoTWRHc0sxd0tRdXg3YlE0NVJ3ZEFa?= =?utf-8?B?RmdjMFRCdCs0TElnekVzdzNGTzY0Y3BwTUMrQVpJRE1Md0hkS1ZQblNveUxV?= =?utf-8?B?Q1kwdlFpdGFlZWNOaWJqa3dkclJWd1FGQy8rUlc4MDJxWWt3M25UN0pTUnd3?= =?utf-8?B?RmZCcVdEU3hvTmtHaVJnYXJBSkg4clNHZnFpaTUwbEFFbTlUUksyTUlYdHRt?= =?utf-8?B?dUEwUjA1dVdVKy9PWTBtdVg2SGh6a0djaHMvMnhTZWxrSmxxWEd2UmszN2Zz?= =?utf-8?B?eGNRemwycDlnbFVnZDVxNkJvdEZZemY5VkY4TGFCNlhPa2h0VDVpZDNwSzdG?= =?utf-8?B?YmhReGpONEZZZUxlR0ZwOFEzMFc1Z0N6TWgvdkRhTmw3Yk1SazRHZFJnOXF6?= =?utf-8?B?VzZXQjRPTjErSjhMVS9qaHZTZTJLUnM2KzR0N0xVVDQ1U3RnaHBIcVNEKzFW?= =?utf-8?B?eEVSYzgxeTVQcWJzbXlVRXRUaFpuTU9xOHJDNEZjdERvODdMY1NXUUt6NUxa?= =?utf-8?B?N0lxVGNKVjVhK1IwTGhQL2lzRG1wWkdPZWNBeXlzT1hpWkhUb3M4NytBT2ky?= =?utf-8?B?NERVWWRoTWdpdDVSUldoT3o1QVNNUU0rbGFuQVFVZTlxRWl5NjEzS3M1dy9n?= =?utf-8?B?UHg1QzlmbGVTTE5zSEkvanl4akNRb0p6WHNHOFhWMmt6V0N2bWR1YUZsUlpI?= =?utf-8?B?cjF1NXBTcE43cTEvZ1c1YnZTOCtVY0RuMVVMbnNVam40ZWpsbE00S05FZnVW?= =?utf-8?B?ZkpWMjhUR1UySktWZmpJeWIvMU1BSXVJN0VqQm9MTzdyS0l1RkthN0E0Y1R1?= =?utf-8?B?STZKU01MVVI0clg3eEpCQm5uUU8vT3FKVFFiY3FEbnQ1dVgwcTFHdGdqVnVJ?= =?utf-8?B?WWlENzA5VXAwelB3dlFkQk54MWRqeDdScmZzb2NHVm5TeTdlZm01WlBhWG4z?= =?utf-8?B?cjk0cUFDVGRGSHdRQ2haQS9CTFFWM2JCY1AwNWN1NUlRQUcxVWZwUHBpVFFk?= =?utf-8?B?azRLeHhZNWJMcVVpOEpoOXlJWlJnTmZSNW5DYVFrWVluQU82VHRpSUFpanBK?= =?utf-8?B?S0lOTm53ekxGcitVMjBzMmwvRDNEV2pjME03ZDF1N1FIM1NQK3Vra2lKZWZm?= =?utf-8?B?c2dqeHBkbmI5VUdFTkR2U0ZYck1aYzBOQVFrVUh6cjEvSG95TFFycG0wZjIw?= =?utf-8?B?SVRnRmpTV01VdDFkZllvUlVvYWJmRzZJQWdVQVprVjlDY1BKemdtQU5uSDU3?= =?utf-8?B?MHkvNG14dmpoSmNudGZENDcrZmFDNmZSbTFhY1Q1UWtuY3VlUWpuVFhCWFhE?= =?utf-8?B?K3JuNkNYVHNxb3JaSWRURjFEdkY1am81aXhIRzhWdTNFdko4dC83WXlFb3lW?= =?utf-8?B?YmVCbFh5d2RodU1OQzYzdDZIQzZnQ1VFUElwZWhodFhsZ2N0VlFOT2czZmFu?= =?utf-8?B?NzdpZUQrclduKzlnbGRvcExmanQzSTFpWTY0Rm1mTTRDOVJyVllxR1ptRkhs?= =?utf-8?Q?HcJNPCEyDiywDsMkSUzV?= X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 893c9c62-1bcc-4bb2-0d16-08db6e9bd551 X-MS-Exchange-CrossTenant-AuthSource: AS8P250MB0744.EURP250.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Jun 2023 18:59:38.3846 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3P250MB0243 Subject: Re: [FFmpeg-devel] [PATCH v2] avformat/jpegxl_anim_dec: avoid overrun with jxlp boxes in container X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: Leo Izen: > This switches the jpegxl_collect_codestream_header function to use > avcodec/bytestream2, which better enforces barriers, and should avoid > overrunning buffers with jxlp boxes if the size is zero or if the size > is so small the box is invalid. > > Signed-off-by: Leo Izen > --- > libavformat/jpegxl_anim_dec.c | 56 +++++++++++++++++++---------------- > 1 file changed, 30 insertions(+), 26 deletions(-) > > diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_dec.c > index 6ea6c46d8f..ec400c955c 100644 > --- a/libavformat/jpegxl_anim_dec.c > +++ b/libavformat/jpegxl_anim_dec.c > @@ -28,6 +28,7 @@ > #include > #include > > +#include "libavcodec/bytestream.h" > #define BITSTREAM_READER_LE > #include "libavcodec/get_bits.h" > > @@ -48,62 +49,65 @@ typedef struct JXLAnimDemuxContext { > * returns the number of bytes consumed from input, may be greater than input_len > * if the input doesn't end on an ISOBMFF-box boundary > */ > -static int jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_len, uint8_t *buffer, int buflen, int *copied) { > - const uint8_t *b = input_buffer; > +static int jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_len, > + uint8_t *buffer, int buflen, int *copied) { > + GetByteContext gb; > *copied = 0; > + bytestream2_init(&gb, input_buffer, input_len); > > while (1) { > uint64_t size; > uint32_t tag; > int head_size = 8; > > - if (b - input_buffer >= input_len - 16) > + if (bytestream2_get_bytes_left(&gb) < 16) > break; > > - size = AV_RB32(b); > - b += 4; > + size = bytestream2_get_be32(&gb); > if (size == 1) { > - size = AV_RB64(b); > - b += 8; > + size = bytestream2_get_be64(&gb); > head_size = 16; > } > /* invalid ISOBMFF size */ > - if (size > 0 && size <= head_size) > + if (size && size <= head_size) > return AVERROR_INVALIDDATA; > - if (size > 0) > + if (size) > size -= head_size; > > - tag = AV_RL32(b); > - b += 4; > + tag = bytestream2_get_le32(&gb); > if (tag == MKTAG('j', 'x', 'l', 'p')) { > - b += 4; > - size -= 4; > + if (bytestream2_get_bytes_left(&gb) < 4) > + break; > + bytestream2_skip(&gb, 4); > + if (size) { > + if (size <= 4) > + return AVERROR_INVALIDDATA; > + size -= 4; > + } > } > + /* > + * size = 0 means "until EOF". this is legal but uncommon > + * here we just set it to the remaining size of the probe buffer > + */ > + if (!size) > + size = bytestream2_get_bytes_left(&gb); > > if (tag == MKTAG('j', 'x', 'l', 'c') || tag == MKTAG('j', 'x', 'l', 'p')) { > - /* > - * size = 0 means "until EOF". this is legal but uncommon > - * here we just set it to the remaining size of the probe buffer > - * which at this point should always be nonnegative > - */ > - if (size == 0 || size > input_len - (b - input_buffer)) > - size = input_len - (b - input_buffer); > - > if (size > buflen - *copied) > size = buflen - *copied; > /* > * arbitrary chunking of the payload makes this memcpy hard to avoid > * in practice this will only be performed one or two times at most > */ > - memcpy(buffer + *copied, b, size); > - *copied += size; > + *copied += bytestream2_get_buffer(&gb, buffer + *copied, size); > + } else { > + bytestream2_skip(&gb, size); > } > - b += size; > - if (b >= input_buffer + input_len || *copied >= buflen) > + if (bytestream2_get_bytes_left(&gb) <= 0 || *copied >= buflen) > break; > } > > - return b - input_buffer; > + return bytestream2_tell(&gb); > } > > static int jpegxl_anim_probe(const AVProbeData *p) Is there an actual (potential) overrun or is this just a precaution? - Andreas _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".