* [FFmpeg-devel] [PATCH 0/1] avcodec/exr: variable string attribute length
@ 2022-05-12 15:30 vectronic
2022-05-12 15:30 ` [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256 vectronic
0 siblings, 1 reply; 3+ messages in thread
From: vectronic @ 2022-05-12 15:30 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: vectronic
fix: use declared size for attribute of type string to ensure full
value used and prevent parse failure for string lengths longer than
256
libavcodec/exr.c | 32 +++++++++++++++++++++++---------
1 file changed, 23 insertions(+), 9 deletions(-)
--
2.32.0 (Apple Git-132)
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 3+ messages in thread
* [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256
2022-05-12 15:30 [FFmpeg-devel] [PATCH 0/1] avcodec/exr: variable string attribute length vectronic
@ 2022-05-12 15:30 ` vectronic
2022-05-14 10:41 ` Paul B Mahol
0 siblings, 1 reply; 3+ messages in thread
From: vectronic @ 2022-05-12 15:30 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: vectronic
Signed-off-by: vectronic <hello.vectronic@gmail.com>
---
libavcodec/exr.c | 32 +++++++++++++++++++++++---------
1 file changed, 23 insertions(+), 9 deletions(-)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 8cd867a32f..bc2afcee53 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1912,10 +1912,13 @@ static int decode_header(EXRContext *s, AVFrame *frame)
continue;
} else if ((var_size = check_header_variable(s, "writer",
"string", 1)) >= 0) {
- uint8_t key[256] = { 0 };
+ uint8_t *key = av_malloc(var_size);
- bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size));
- av_dict_set(&metadata, "writer", key, 0);
+ if (!key)
+ return AVERROR(ENOMEM);
+
+ bytestream2_get_buffer(gb, key, var_size);
+ av_dict_set(&metadata, "writer", key, AV_DICT_DONT_STRDUP_VAL);
continue;
} else if ((var_size = check_header_variable(s, "framesPerSecond",
@@ -1937,9 +1940,12 @@ static int decode_header(EXRContext *s, AVFrame *frame)
continue;
} else if ((var_size = check_header_variable(s, "type",
"string", 16)) >= 0) {
- uint8_t key[256] = { 0 };
+ uint8_t *key = av_malloc(var_size);
+
+ if (!key)
+ return AVERROR(ENOMEM);
- bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size));
+ bytestream2_get_buffer(gb, key, var_size);
if (strncmp("scanlineimage", key, var_size) &&
strncmp("tiledimage", key, var_size))
return AVERROR_PATCHWELCOME;
@@ -1970,7 +1976,6 @@ static int decode_header(EXRContext *s, AVFrame *frame)
{
uint8_t name[256] = { 0 };
uint8_t type[256] = { 0 };
- uint8_t value[256] = { 0 };
int i = 0, size;
while (bytestream2_get_bytes_left(gb) > 0 &&
@@ -1987,9 +1992,18 @@ static int decode_header(EXRContext *s, AVFrame *frame)
bytestream2_skip(gb, 1);
size = bytestream2_get_le32(gb);
- bytestream2_get_buffer(gb, value, FFMIN(sizeof(value) - 1, size));
- if (!strcmp(type, "string"))
- av_dict_set(&metadata, name, value, 0);
+ if (strcmp(type, "string") != 0) {
+ bytestream2_skip(gb, size);
+
+ continue;
+ }
+ uint8_t *value = av_malloc(size);
+
+ if (!value)
+ return AVERROR(ENOMEM);
+
+ bytestream2_get_buffer(gb, value, size);
+ av_dict_set(&metadata, name, value, AV_DICT_DONT_STRDUP_VAL);
}
}
--
2.32.0 (Apple Git-132)
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256
2022-05-12 15:30 ` [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256 vectronic
@ 2022-05-14 10:41 ` Paul B Mahol
0 siblings, 0 replies; 3+ messages in thread
From: Paul B Mahol @ 2022-05-14 10:41 UTC (permalink / raw)
To: FFmpeg development discussions and patches; +Cc: vectronic
On Thu, May 12, 2022 at 5:31 PM vectronic <hello.vectronic@gmail.com> wrote:
> Signed-off-by: vectronic <hello.vectronic@gmail.com>
> ---
> libavcodec/exr.c | 32 +++++++++++++++++++++++---------
> 1 file changed, 23 insertions(+), 9 deletions(-)
>
> diff --git a/libavcodec/exr.c b/libavcodec/exr.c
> index 8cd867a32f..bc2afcee53 100644
> --- a/libavcodec/exr.c
> +++ b/libavcodec/exr.c
> @@ -1912,10 +1912,13 @@ static int decode_header(EXRContext *s, AVFrame
> *frame)
> continue;
> } else if ((var_size = check_header_variable(s, "writer",
> "string", 1)) >= 0) {
> - uint8_t key[256] = { 0 };
> + uint8_t *key = av_malloc(var_size);
>
> - bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1,
> var_size));
> - av_dict_set(&metadata, "writer", key, 0);
> + if (!key)
> + return AVERROR(ENOMEM);
> +
> + bytestream2_get_buffer(gb, key, var_size);
> + av_dict_set(&metadata, "writer", key,
> AV_DICT_DONT_STRDUP_VAL);
>
var_size can be very big number, potentially causing attacks vectors.
>
> continue;
> } else if ((var_size = check_header_variable(s, "framesPerSecond",
> @@ -1937,9 +1940,12 @@ static int decode_header(EXRContext *s, AVFrame
> *frame)
> continue;
> } else if ((var_size = check_header_variable(s, "type",
> "string", 16)) >= 0)
> {
> - uint8_t key[256] = { 0 };
> + uint8_t *key = av_malloc(var_size);
> +
> + if (!key)
> + return AVERROR(ENOMEM);
>
> - bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1,
> var_size));
> + bytestream2_get_buffer(gb, key, var_size);
> if (strncmp("scanlineimage", key, var_size) &&
> strncmp("tiledimage", key, var_size))
> return AVERROR_PATCHWELCOME;
> @@ -1970,7 +1976,6 @@ static int decode_header(EXRContext *s, AVFrame
> *frame)
> {
> uint8_t name[256] = { 0 };
> uint8_t type[256] = { 0 };
> - uint8_t value[256] = { 0 };
> int i = 0, size;
>
> while (bytestream2_get_bytes_left(gb) > 0 &&
> @@ -1987,9 +1992,18 @@ static int decode_header(EXRContext *s, AVFrame
> *frame)
> bytestream2_skip(gb, 1);
> size = bytestream2_get_le32(gb);
>
> - bytestream2_get_buffer(gb, value, FFMIN(sizeof(value) - 1,
> size));
> - if (!strcmp(type, "string"))
> - av_dict_set(&metadata, name, value, 0);
> + if (strcmp(type, "string") != 0) {
> + bytestream2_skip(gb, size);
> +
> + continue;
> + }
> + uint8_t *value = av_malloc(size);
> +
> + if (!value)
> + return AVERROR(ENOMEM);
> +
> + bytestream2_get_buffer(gb, value, size);
> + av_dict_set(&metadata, name, value, AV_DICT_DONT_STRDUP_VAL);
> }
> }
>
> --
> 2.32.0 (Apple Git-132)
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-05-14 10:38 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-12 15:30 [FFmpeg-devel] [PATCH 0/1] avcodec/exr: variable string attribute length vectronic
2022-05-12 15:30 ` [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256 vectronic
2022-05-14 10:41 ` Paul B Mahol
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git