* [FFmpeg-devel] [PATCH] avformat/asfdec_f: Check amount of value read @ 2025-07-23 8:43 Michael Niedermayer 2025-07-23 15:51 ` Kacper Michajlow 0 siblings, 1 reply; 5+ messages in thread From: Michael Niedermayer @ 2025-07-23 8:43 UTC (permalink / raw) To: FFmpeg development discussions and patches Fixes: use of uninitialized memory Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/asfdec_f.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index ea6e8ef4f3a..10f5dea57c3 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -241,7 +241,9 @@ static void get_tag(AVFormatContext *s, const char *key, int type, int len, int avio_get_str16le(s->pb, len, value, 2 * len + 1); break; case -1: // ASCI - avio_read(s->pb, value, len); + ;int ret = ffio_read_size(s->pb, value, len); + if (ret < 0) + goto finish; value[len]=0; break; case ASF_BYTE_ARRAY: -- 2.49.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/asfdec_f: Check amount of value read 2025-07-23 8:43 [FFmpeg-devel] [PATCH] avformat/asfdec_f: Check amount of value read Michael Niedermayer @ 2025-07-23 15:51 ` Kacper Michajlow 2025-07-27 20:57 ` Michael Niedermayer 0 siblings, 1 reply; 5+ messages in thread From: Kacper Michajlow @ 2025-07-23 15:51 UTC (permalink / raw) To: FFmpeg development discussions and patches On Wed, 23 Jul 2025 at 10:43, Michael Niedermayer <michael@niedermayer.cc> wrote: > > Fixes: use of uninitialized memory > Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/asfdec_f.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c > index ea6e8ef4f3a..10f5dea57c3 100644 > --- a/libavformat/asfdec_f.c > +++ b/libavformat/asfdec_f.c > @@ -241,7 +241,9 @@ static void get_tag(AVFormatContext *s, const char *key, int type, int len, int > avio_get_str16le(s->pb, len, value, 2 * len + 1); > break; > case -1: // ASCI > - avio_read(s->pb, value, len); > + ;int ret = ffio_read_size(s->pb, value, len); stray ; > + if (ret < 0) > + goto finish; > value[len]=0; > break; > case ASF_BYTE_ARRAY: > -- > 2.49.0 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/asfdec_f: Check amount of value read 2025-07-23 15:51 ` Kacper Michajlow @ 2025-07-27 20:57 ` Michael Niedermayer 2025-07-27 23:10 ` Kacper Michajlow 0 siblings, 1 reply; 5+ messages in thread From: Michael Niedermayer @ 2025-07-27 20:57 UTC (permalink / raw) To: FFmpeg development discussions and patches [-- Attachment #1.1: Type: text/plain, Size: 1624 bytes --] On Wed, Jul 23, 2025 at 05:51:35PM +0200, Kacper Michajlow wrote: > On Wed, 23 Jul 2025 at 10:43, Michael Niedermayer > <michael@niedermayer.cc> wrote: > > > > Fixes: use of uninitialized memory > > Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/asfdec_f.c | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c > > index ea6e8ef4f3a..10f5dea57c3 100644 > > --- a/libavformat/asfdec_f.c > > +++ b/libavformat/asfdec_f.c > > @@ -241,7 +241,9 @@ static void get_tag(AVFormatContext *s, const char *key, int type, int len, int > > avio_get_str16le(s->pb, len, value, 2 * len + 1); > > break; > > case -1: // ASCI > > - avio_read(s->pb, value, len); > > + ;int ret = ffio_read_size(s->pb, value, len); > > stray ; no, try remove it :) libavformat/asfdec_f.c: In function ‘get_tag’: libavformat/asfdec_f.c:244:9: error: a label can only be part of a statement and a declaration is not a statement 244 | int ret = ffio_read_size(s->pb, value, len); | ^~~ thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB The bravest are surely those who have the clearest vision of what is before them, glory and danger alike, and yet notwithstanding go out to meet it. -- Thucydides [-- Attachment #1.2: signature.asc --] [-- Type: application/pgp-signature, Size: 195 bytes --] [-- Attachment #2: Type: text/plain, Size: 251 bytes --] _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/asfdec_f: Check amount of value read 2025-07-27 20:57 ` Michael Niedermayer @ 2025-07-27 23:10 ` Kacper Michajlow 2025-07-28 15:39 ` Michael Niedermayer 0 siblings, 1 reply; 5+ messages in thread From: Kacper Michajlow @ 2025-07-27 23:10 UTC (permalink / raw) To: FFmpeg development discussions and patches On Sun, 27 Jul 2025 at 22:57, Michael Niedermayer <michael@niedermayer.cc> wrote: > > On Wed, Jul 23, 2025 at 05:51:35PM +0200, Kacper Michajlow wrote: > > On Wed, 23 Jul 2025 at 10:43, Michael Niedermayer > > <michael@niedermayer.cc> wrote: > > > > > > Fixes: use of uninitialized memory > > > Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248 > > > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > > --- > > > libavformat/asfdec_f.c | 4 +++- > > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > > > diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c > > > index ea6e8ef4f3a..10f5dea57c3 100644 > > > --- a/libavformat/asfdec_f.c > > > +++ b/libavformat/asfdec_f.c > > > @@ -241,7 +241,9 @@ static void get_tag(AVFormatContext *s, const char *key, int type, int len, int > > > avio_get_str16le(s->pb, len, value, 2 * len + 1); > > > break; > > > case -1: // ASCI > > > - avio_read(s->pb, value, len); > > > + ;int ret = ffio_read_size(s->pb, value, len); > > > > stray ; > > no, try remove it :) > > libavformat/asfdec_f.c: In function ‘get_tag’: > libavformat/asfdec_f.c:244:9: error: a label can only be part of a statement and a declaration is not a statement > 244 | int ret = ffio_read_size(s->pb, value, len); > | ^~~ Ah, right. It's the first line after the case statement. I generally put it immediately after : `case -1:;`. It was looking off at the beginning of the line, but all good :) - Kacper _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/asfdec_f: Check amount of value read 2025-07-27 23:10 ` Kacper Michajlow @ 2025-07-28 15:39 ` Michael Niedermayer 0 siblings, 0 replies; 5+ messages in thread From: Michael Niedermayer @ 2025-07-28 15:39 UTC (permalink / raw) To: FFmpeg development discussions and patches [-- Attachment #1.1: Type: text/plain, Size: 2043 bytes --] On Mon, Jul 28, 2025 at 01:10:57AM +0200, Kacper Michajlow wrote: > On Sun, 27 Jul 2025 at 22:57, Michael Niedermayer > <michael@niedermayer.cc> wrote: > > > > On Wed, Jul 23, 2025 at 05:51:35PM +0200, Kacper Michajlow wrote: > > > On Wed, 23 Jul 2025 at 10:43, Michael Niedermayer > > > <michael@niedermayer.cc> wrote: > > > > > > > > Fixes: use of uninitialized memory > > > > Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248 > > > > > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > > > --- > > > > libavformat/asfdec_f.c | 4 +++- > > > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > > > > > diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c > > > > index ea6e8ef4f3a..10f5dea57c3 100644 > > > > --- a/libavformat/asfdec_f.c > > > > +++ b/libavformat/asfdec_f.c > > > > @@ -241,7 +241,9 @@ static void get_tag(AVFormatContext *s, const char *key, int type, int len, int > > > > avio_get_str16le(s->pb, len, value, 2 * len + 1); > > > > break; > > > > case -1: // ASCI > > > > - avio_read(s->pb, value, len); > > > > + ;int ret = ffio_read_size(s->pb, value, len); > > > > > > stray ; > > > > no, try remove it :) > > > > libavformat/asfdec_f.c: In function ‘get_tag’: > > libavformat/asfdec_f.c:244:9: error: a label can only be part of a statement and a declaration is not a statement > > 244 | int ret = ffio_read_size(s->pb, value, len); > > | ^~~ > > Ah, right. It's the first line after the case statement. > > I generally put it immediately after : `case -1:;`. It was looking off > at the beginning of the line, but all good :) ill move to after the : thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB The misfortune of the wise is better than the prosperity of the fool. -- Epicurus [-- Attachment #1.2: signature.asc --] [-- Type: application/pgp-signature, Size: 195 bytes --] [-- Attachment #2: Type: text/plain, Size: 251 bytes --] _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-07-28 15:40 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2025-07-23 8:43 [FFmpeg-devel] [PATCH] avformat/asfdec_f: Check amount of value read Michael Niedermayer 2025-07-23 15:51 ` Kacper Michajlow 2025-07-27 20:57 ` Michael Niedermayer 2025-07-27 23:10 ` Kacper Michajlow 2025-07-28 15:39 ` Michael Niedermayer
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel This inbox may be cloned and mirrored by anyone: git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \ ffmpegdev@gitmailbox.com public-inbox-index ffmpegdev Example config snippet for mirrors. AGPL code for this site: git clone https://public-inbox.org/public-inbox.git