From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id ADD31471BF for ; Thu, 14 Aug 2025 14:15:14 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id A199668CF80; Thu, 14 Aug 2025 17:15:12 +0300 (EEST) Received: from mail-yw1-f170.google.com (mail-yw1-f170.google.com [209.85.128.170]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 25C2C68CF80 for ; Thu, 14 Aug 2025 17:15:10 +0300 (EEST) Received: by mail-yw1-f170.google.com with SMTP id 00721157ae682-71d603b60cbso8684437b3.1 for ; Thu, 14 Aug 2025 07:15:10 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1755180909; x=1755785709; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=tWRcVCiZSeY4wcmrIaVgnFSCn8wxckGwXmETPidC52Y=; b=rJPnHiozVxjKWHU5MiklGtESYbSXrSO3UNHLdhwVT/2nOcILEqpabKKmISDCGEfQ9+ PAOUKQc5NofhS0VhkYOXrDGCx3WdK58q3bXs/+mIOXf2p7unN6H9U8uTXx7juxqhhSuj CyFRU8+ykYfc30Cp6OCQI4EAVDVIG9nLLSGUmCWlw7qngJ4TKNV/JJ1YPc3fuaaoSjM2 IjT6V0t5zuNf2jwJWHB9q8M0cgdbApN5Z42LsZWkx3X+/2tlIVeT9vE/JxUjje+36tMh lm/P+KUhwrTgbbQKWeQE/LvCxoAnAc3tjM4os2FH7vY/qG0hgrcRc6MVDw/TITC59jqj bh4Q== X-Gm-Message-State: AOJu0YxawIHOcfc/TtKi4DF37kslGDuzbOLHaA91icVNF9YTUXllbK2l ueMjj016Xn/aSNcJD0MykHqnTYNVb6rHdDCTxN+rLuyiVu3bA3XnGEvuN0N2sboClu7tgdCAku/ e3l9+wHfW0HvuQvneVmKjbGfoPsilSm53aw== X-Gm-Gg: ASbGncvbawGzaWfhFlfF7tqtuCqaiTiKvsoWdVNskrPnbkjHtf1HSSlPCdX6VxZE+Me 7XE0TLboSHMBfiSDl+5WyjJ/kqFKRHWHa77+BWhhudp5g7TuOB2+cd3LJYakeBPAlvQxdlp13dq oQNFTt55GmmILQwSUh9vVix6NTvuunCsaNd9QUtw6Grihqkm8wYMksKM4uMlHrVfm7SmqoKm8Ww jcEHs3NXd6xxmRZ6xI= X-Google-Smtp-Source: AGHT+IEyWhGgXISCyRpcCpNbWRDxED+T8hJq43FyDqDhs/qeSWSl7xoWDBIp32CWzcyibWyxj0TH+lAxUfEPCeq8sls= X-Received: by 2002:a05:690c:2603:b0:719:5329:6e11 with SMTP id 00721157ae682-71d6361c4a2mr46974987b3.39.1755180909194; Thu, 14 Aug 2025 07:15:09 -0700 (PDT) MIME-Version: 1.0 References: <20250814002549.6431A68CFFE@ffbox0-bg.ffmpeg.org> <20250814100755.GP29660@pb2> In-Reply-To: <20250814100755.GP29660@pb2> Date: Thu, 14 Aug 2025 04:14:58 -1000 X-Gm-Features: Ac12FXyqSCoJNAsDDR-CMd3Ck_UewgJ12Etwt0eVBcN4HeG8EZ8gdHMrbjjQWOs Message-ID: To: FFmpeg development discussions and patches X-Content-Filtered-By: Mailman/MimeDel 2.1.29 Subject: Re: [FFmpeg-devel] [PATCH] avutil/timecode: Check for integer overflow in av_timecode_init_from_components() (PR #20236) X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Kieran Kunhya via ffmpeg-devel Reply-To: FFmpeg development discussions and patches Cc: Kieran Kunhya Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On Thu, 14 Aug 2025, 00:08 Michael Niedermayer, wrote: > On Wed, Aug 13, 2025 at 03:36:43PM -1000, Kieran Kunhya via ffmpeg-devel > wrote: > > On Wed, 13 Aug 2025, 14:25 michaelni, wrote: > > > > > PR #20236 opened by michaelni > > > URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20236 > > > Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20236.patch > > > > > > Fixes: integer overflow > > > Fixes: testcase that calls av_timecode_init_from_components() with hh > set > > > explicitly to INT_MAX > > > > > > Found-by: Youngjae Choi, Mingyoung Ban, Seunghoon Woo > > > Signed-off-by: Michael Niedermayer > > > > > > > > > From 0762e660ff8fb8c2f4c3d46a6a6c821bd69633e6 Mon Sep 17 00:00:00 2001 > > > From: Michael Niedermayer > > > Date: Thu, 14 Aug 2025 02:12:26 +0200 > > > Subject: [PATCH] avutil/timecode: Check for integer overflow in > > > av_timecode_init_from_components() > > > > > > Fixes: integer overflow > > > Fixes: testcase that calls av_timecode_init_from_components() with hh > set > > > explicitly to INT_MAX > > > > > > Found-by: Youngjae Choi, Mingyoung Ban, Seunghoon Woo > > > Signed-off-by: Michael Niedermayer > > > --- > > > libavutil/timecode.c | 11 ++++++++++- > > > 1 file changed, 10 insertions(+), 1 deletion(-) > > > > > > diff --git a/libavutil/timecode.c b/libavutil/timecode.c > > > index bca16b6ac2..052c488071 100644 > > > --- a/libavutil/timecode.c > > > +++ b/libavutil/timecode.c > > > @@ -211,6 +211,7 @@ int av_timecode_init(AVTimecode *tc, AVRational > rate, > > > int flags, int frame_start > > > int av_timecode_init_from_components(AVTimecode *tc, AVRational rate, > int > > > flags, int hh, int mm, int ss, int ff, void *log_ctx) > > > { > > > int ret; > > > + int64_t s; > > > > > > memset(tc, 0, sizeof(*tc)); > > > tc->flags = flags; > > > @@ -221,7 +222,15 @@ int av_timecode_init_from_components(AVTimecode > *tc, > > > AVRational rate, int flags, > > > if (ret < 0) > > > return ret; > > > > > > - tc->start = (hh*3600 + mm*60 + ss) * tc->fps + ff; > > > + s = hh*3600LL + mm*60LL + ss; > > > + if (s != (int32_t)s) > > > + return AVERROR(EINVAL); > > > + > > > + s = s * tc->fps + ff; > > > + if (s != (int32_t)s) > > > + return AVERROR(EINVAL); > > > + tc->start = s; > > > + > > > if (tc->flags & AV_TIMECODE_FLAG_DROPFRAME) { /* adjust frame > number > > > */ > > > int tmins = 60*hh + mm; > > > tc->start -= (tc->fps / 30 * 2) * (tmins - tmins/10); > > > -- > > > 2.49.1 > > > > > > > What is the actual security benefit of this? > > in reality, probably none > in theory, it fixes undefined behavior for a range of values that is > not forbidden by the API > > > > If someone chooses INT_MAX as > > their timecode value, surely they have to expect it overflows? > > this was reported to us as a security issue > there also was a seperate one with tc=NULL crashing. But that > violated the API, so it didnt make it to forgejo > > thx > > [...] > -- > I don't think we should partake in this "security vulnerability farming" exercise. This isn't a security issue and it spams the code with integer overflow checks to fix a theoretical issue. Kieran > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".