[FFmpeg-devel] [PATCH] avformat/dhav: Don't truncate return value of avio_skip()

[FFmpeg-devel] [PATCH] avformat/dhav: Don't truncate return value of avio_skip()

[Andreas Rheinhardt]

Fixes demuxing files bigger than INT_MAX.

Reported-by: jenster
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
This has just been reported by jenster on IRC:

<jenster> I found a bug in libavformat/dhav.c where it fails to demux files > INT_MAX. It's basically assigning the result of avio_skip (which returns an int64_t file offset) to an int in two places which it then checks if it's less than 0 and when the file is bigger than INT_MAX it overflows and becomes negative and errors out (this seems like something
<jenster> that static analysis should find). It's a two line fix (basically just change two ints to int64_t) https://pastebin.com/iUGe9cza (licensed CC0). Would anyone be able to  submit this change or fix it their own way? I don't care about credit and I really don't want to bother with the whole patch submission process for this trivial change.

 libavformat/dhav.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavformat/dhav.c b/libavformat/dhav.c
index 60aab8cabd..9d26efe8fc 100644
--- a/libavformat/dhav.c
+++ b/libavformat/dhav.c
@@ -78,10 +78,11 @@ static const uint32_t sample_rates[] = {
 static int parse_ext(AVFormatContext *s, int length)
 {
     DHAVContext *dhav = s->priv_data;
-    int index, ret = 0;
+    int64_t ret = 0;
 
     while (length > 0) {
         int type = avio_r8(s->pb);
+        int index;
 
         switch (type) {
         case 0x80:
@@ -168,8 +169,7 @@ static int read_chunk(AVFormatContext *s)
 {
     DHAVContext *dhav = s->priv_data;
     int frame_length, ext_length;
-    int64_t start, end;
-    int ret;
+    int64_t start, end, ret;
 
     if (avio_feof(s->pb))
         return AVERROR_EOF;
-- 
2.32.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avformat/dhav: Don't truncate return value of avio_skip()

[Andreas Rheinhardt]

Andreas Rheinhardt:
> Fixes demuxing files bigger than INT_MAX.
> 
> Reported-by: jenster
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
> ---
> This has just been reported by jenster on IRC:
> 
> <jenster> I found a bug in libavformat/dhav.c where it fails to demux files > INT_MAX. It's basically assigning the result of avio_skip (which returns an int64_t file offset) to an int in two places which it then checks if it's less than 0 and when the file is bigger than INT_MAX it overflows and becomes negative and errors out (this seems like something
> <jenster> that static analysis should find). It's a two line fix (basically just change two ints to int64_t) https://pastebin.com/iUGe9cza (licensed CC0). Would anyone be able to  submit this change or fix it their own way? I don't care about credit and I really don't want to bother with the whole patch submission process for this trivial change.
> 
>  libavformat/dhav.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/libavformat/dhav.c b/libavformat/dhav.c
> index 60aab8cabd..9d26efe8fc 100644
> --- a/libavformat/dhav.c
> +++ b/libavformat/dhav.c
> @@ -78,10 +78,11 @@ static const uint32_t sample_rates[] = {
>  static int parse_ext(AVFormatContext *s, int length)
>  {
>      DHAVContext *dhav = s->priv_data;
> -    int index, ret = 0;
> +    int64_t ret = 0;
>  
>      while (length > 0) {
>          int type = avio_r8(s->pb);
> +        int index;
>  
>          switch (type) {
>          case 0x80:
> @@ -168,8 +169,7 @@ static int read_chunk(AVFormatContext *s)
>  {
>      DHAVContext *dhav = s->priv_data;
>      int frame_length, ext_length;
> -    int64_t start, end;
> -    int ret;
> +    int64_t start, end, ret;
>  
>      if (avio_feof(s->pb))
>          return AVERROR_EOF;

Will apply later today unless there are objections.

- Andreas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".