From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id AB1E24513A for ; Thu, 14 Aug 2025 01:37:08 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id C99F368CFA2; Thu, 14 Aug 2025 04:37:04 +0300 (EEST) Received: from mail-yw1-f178.google.com (mail-yw1-f178.google.com [209.85.128.178]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 90A3B687BA4 for ; Thu, 14 Aug 2025 04:36:57 +0300 (EEST) Received: by mail-yw1-f178.google.com with SMTP id 00721157ae682-71d605bbcfdso5177117b3.3 for ; Wed, 13 Aug 2025 18:36:57 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1755135416; x=1755740216; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=YZGFjuMjSkT6pheKQjfXYkHRwaqbgIxiW8KMyN6TLU4=; b=Hv0QSKu0IX5BHOILe0xwA3oqmlO5q2meqazXe1vg8Ba7b1HzVYZpLk56b6P0T2o1bR PZ5w1Op6MNdnY4Bsj+0PWdpYD/d9hCEPg9wM3uhFMA/VcXvV+PDJdTECu9PPvSAaKfWG qYEY1pHjuK+3OnHurzSu2s+WUWVFH4gWJGQUDzF3MizzhBwWeIiR4upfjVjO87rPOl0p bMILnsdVE8NY0RPMmVk5oy2ULkQoT/STKAdZAJVn0g1Tg/20ZKemDnHGdkUtQQQ/Zy0R y+P2ANisTdBtmnvIDtbqXAln/0g3M1I5V5B7r/83n/zRA7Skamj4biiBUjLQ+Hp7ijeK Q/1A== X-Gm-Message-State: AOJu0YwIX/7nBUwHnHu9Fok+m68KUOa5W9GTK/MF2f7JOwXmYY4CicJR Tt4DBRVs31AdSUFiRQO2q9IJ/JoHG1kATQaBrlCO0GjlReOZxz4jKPYsFg7+6S1lv4z35MgLC3j f53s3sKE2IXzOkhwoVuen3Y3wMnKnRXhqPw== X-Gm-Gg: ASbGncv0sHtPRc6py6ZDMwuAsq43AI49LnDA5vZMuATOoqKmkPW50iijEJ2GGpXDCLD 7NtRA4vz7KNKxOnWW/BI4AFkJ1YW5MZmf/q1vYMg+rRtxgEec9IIoUWODiIR9s6f0DcFjpzZ2mu viBJ1POFrl7Lrc9A8BJ3YwC05YEEuNNGTHNiNG0loVZxPiBgJZTTHBGwLk2Vd/dK+gS7/PvhUOc bGMobml43GnVAkx5g== X-Google-Smtp-Source: AGHT+IGAyVMs48wCwCvNydegiEdmLr78crMkJHYnS9wiBszf1yujVJVH+RBx9e4+SWZFErmt13wKnIzrNblJ6132MDg= X-Received: by 2002:a05:690c:22c5:b0:6ef:6d61:c254 with SMTP id 00721157ae682-71d6360a221mr14054277b3.38.1755135413943; Wed, 13 Aug 2025 18:36:53 -0700 (PDT) MIME-Version: 1.0 References: <20250814002549.6431A68CFFE@ffbox0-bg.ffmpeg.org> In-Reply-To: <20250814002549.6431A68CFFE@ffbox0-bg.ffmpeg.org> Date: Wed, 13 Aug 2025 15:36:43 -1000 X-Gm-Features: Ac12FXzMQveACdYSnnxXPQoM-0uhGWNWWs175mtmGmkCvUIAS4fzf00QXuFss60 Message-ID: To: FFmpeg development discussions and patches X-Content-Filtered-By: Mailman/MimeDel 2.1.29 Subject: Re: [FFmpeg-devel] [PATCH] avutil/timecode: Check for integer overflow in av_timecode_init_from_components() (PR #20236) X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Kieran Kunhya via ffmpeg-devel Reply-To: FFmpeg development discussions and patches Cc: Kieran Kunhya Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On Wed, 13 Aug 2025, 14:25 michaelni, wrote: > PR #20236 opened by michaelni > URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20236 > Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20236.patch > > Fixes: integer overflow > Fixes: testcase that calls av_timecode_init_from_components() with hh set > explicitly to INT_MAX > > Found-by: Youngjae Choi, Mingyoung Ban, Seunghoon Woo > Signed-off-by: Michael Niedermayer > > > From 0762e660ff8fb8c2f4c3d46a6a6c821bd69633e6 Mon Sep 17 00:00:00 2001 > From: Michael Niedermayer > Date: Thu, 14 Aug 2025 02:12:26 +0200 > Subject: [PATCH] avutil/timecode: Check for integer overflow in > av_timecode_init_from_components() > > Fixes: integer overflow > Fixes: testcase that calls av_timecode_init_from_components() with hh set > explicitly to INT_MAX > > Found-by: Youngjae Choi, Mingyoung Ban, Seunghoon Woo > Signed-off-by: Michael Niedermayer > --- > libavutil/timecode.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/libavutil/timecode.c b/libavutil/timecode.c > index bca16b6ac2..052c488071 100644 > --- a/libavutil/timecode.c > +++ b/libavutil/timecode.c > @@ -211,6 +211,7 @@ int av_timecode_init(AVTimecode *tc, AVRational rate, > int flags, int frame_start > int av_timecode_init_from_components(AVTimecode *tc, AVRational rate, int > flags, int hh, int mm, int ss, int ff, void *log_ctx) > { > int ret; > + int64_t s; > > memset(tc, 0, sizeof(*tc)); > tc->flags = flags; > @@ -221,7 +222,15 @@ int av_timecode_init_from_components(AVTimecode *tc, > AVRational rate, int flags, > if (ret < 0) > return ret; > > - tc->start = (hh*3600 + mm*60 + ss) * tc->fps + ff; > + s = hh*3600LL + mm*60LL + ss; > + if (s != (int32_t)s) > + return AVERROR(EINVAL); > + > + s = s * tc->fps + ff; > + if (s != (int32_t)s) > + return AVERROR(EINVAL); > + tc->start = s; > + > if (tc->flags & AV_TIMECODE_FLAG_DROPFRAME) { /* adjust frame number > */ > int tmins = 60*hh + mm; > tc->start -= (tc->fps / 30 * 2) * (tmins - tmins/10); > -- > 2.49.1 > What is the actual security benefit of this? If someone chooses INT_MAX as their timecode value, surely they have to expect it overflows? Kieran > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".