From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 54B0A4AFF9 for ; Fri, 21 Feb 2025 03:32:20 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 9BD6068C638; Fri, 21 Feb 2025 05:32:16 +0200 (EET) Received: from mail-yb1-f174.google.com (mail-yb1-f174.google.com [209.85.219.174]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 980F268C218 for ; Fri, 21 Feb 2025 05:32:10 +0200 (EET) Received: by mail-yb1-f174.google.com with SMTP id 3f1490d57ef6-e5dab3f37b1so1374160276.0 for ; Thu, 20 Feb 2025 19:32:10 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740108728; x=1740713528; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=ZZOEc24eo4YS4v0jV0MgQYPvda80QzfGNNlp8w/M80M=; b=bhcVexOY24pedzXxkKCLdZlzLgFS0FMlLZ868L1NNHW+OwgdE/9eQx1QRh7UFLk9jf Fmk0v6RJTQshGhG/tvAEhrHvrlZUoMyBXC/7NK3G6k4gKXvh+Z1mjmW0m9Ic0DD3yRro 3w0Yu3y96TilVjWFI0Ln0KoiSXDJYbTKuX2RMivNnaeq6LSmzAbX5k5obUNdjchtFgL6 DXFjryYm7TV3jtwmTAjly+SeJCHrs7oOACmJjsNddxeiCGIVt6x/3nZkJx5zc6jEhwud /jxc7Iv7dKb8ay/WzOg3dI2rZf0gNX/nbaggqRzSXigZd8zUmBrW+bF2NfU9JkaqXwxN bKSw== X-Gm-Message-State: AOJu0Yx/MWQA+WGqueaBqvN45l3bX8y9Blgnbo0FMzg2C2/+DbStueFB TygDr504GuWVzOpk9iadacU6ssrMosp3ksPAt95y662aqD6OdAre0l6XMkVsKAsF1gwrIvVpMDh hTQfpBOjBF0eVkL/F3fQ09joIVSvQsYPYZX3ZVBJ/r191PG3cUuY= X-Gm-Gg: ASbGncu4z7nVLRb67sGm6bD9jODNfBOP4+kqnUhcieVjMBUOzNzCcUeQDDEuloqb/bM eA6LV4v9yvCYUi7zJpFo7aiFVAwO4TYoUuLzSNG2TAlmW6rMIJrjpvZHptD0vtRmEdj2Y8RMVtk z4gFRLrGe5G8xgxO0QWw== X-Google-Smtp-Source: AGHT+IG1Du1okwiDx8nhz4loHw/vy2S0uxRhMv08ApB9MiRx1lIu/XszvCLmZKd2NKhVyKRiVl2mcFwGYdesMUGSkqw= X-Received: by 2002:a05:6902:2086:b0:e5a:c837:a8c1 with SMTP id 3f1490d57ef6-e5e83f1ed6dmr881054276.8.1740108728615; Thu, 20 Feb 2025 19:32:08 -0800 (PST) MIME-Version: 1.0 Date: Thu, 20 Feb 2025 22:31:57 -0500 X-Gm-Features: AWEUYZk1DqY4wUkGRgTJX4UL8IIOZBxE4PU1-FY7f1sFS7ZAOd4AYiDDFlgsPJ8 Message-ID: To: ffmpeg-devel@ffmpeg.org Content-Type: multipart/mixed; boundary="000000000000a54fa5062e9ea2fc" Subject: [FFmpeg-devel] [PATCH] libavfilter: guard against ff_draw_init/ff_draw_init2 failures X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Nil Fons Miret via ffmpeg-devel Reply-To: FFmpeg development discussions and patches Cc: Nil Fons Miret Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --000000000000a54fa5062e9ea2fc Content-Type: text/plain; charset="UTF-8" The return value of ff_draw_init and ff_draw_init2 are not checked in most usages. However, if they return an error, they don't get to the point where they set the attributes of the FFDrawContext. These functions are typically used in conjunction with ff_draw_color, which checks draw->desc->flags, causing a null pointer dereference. Attaching patch with a fix to guard against this. Thanks, Nil --000000000000a54fa5062e9ea2fc Content-Type: message/rfc822; name="0001-libavfilter-guard-against-ff_draw_init-ff_draw_init2-f.eml" Content-Disposition: attachment; filename="0001-libavfilter-guard-against-ff_draw_init-ff_draw_init2-f.eml" Content-ID: X-Attachment-Id: f_m7e7muj30 From: Nil Fons Miret Date: Fri, 21 Feb 2025 01:18:21 +0000 Subject: [PATCH] libavfilter: guard against ff_draw_init/ff_draw_init2 failures X-Unsent: 1 To: ffmpeg-devel@ffmpeg.org The return value of ff_draw_init and ff_draw_init2 are not checked in most usages. However, if they return an error, they don't get to the point where they set the attributes of the FFDrawContext. These functions are typically used in conjunction with ff_draw_color, which checks draw->desc->flags, causing a null pointer dereference. Signed-off-by: Nil Fons Miret --- libavfilter/qrencode.c | 26 +++++++++++++++++++++----- libavfilter/src_avsynctest.c | 7 ++++++- libavfilter/vf_datascope.c | 31 +++++++++++++++++++++++++------ libavfilter/vf_drawtext.c | 6 +++++- libavfilter/vf_pad.c | 6 +++++- libavfilter/vf_shear.c | 7 ++++++- libavfilter/vf_stack.c | 6 +++++- libavfilter/vf_subtitles.c | 16 +++++++++++----- libavfilter/vf_tile.c | 7 ++++++- libavfilter/vf_tinterlace.c | 6 +++++- libavfilter/vf_tpad.c | 7 ++++++- libavfilter/vsrc_testsrc.c | 9 +++++++-- 12 files changed, 108 insertions(+), 26 deletions(-) diff --git a/libavfilter/qrencode.c b/libavfilter/qrencode.c index f96cc8dc93..0eb4dd5c5c 100644 --- a/libavfilter/qrencode.c +++ b/libavfilter/qrencode.c @@ -636,11 +636,19 @@ static int qrencodesrc_config_props(AVFilterLink *outlink) return AVERROR(EINVAL); } - ff_draw_init(&qr->draw, AV_PIX_FMT_ARGB, FF_DRAW_PROCESS_ALPHA); + ret = ff_draw_init(&qr->draw, AV_PIX_FMT_ARGB, FF_DRAW_PROCESS_ALPHA); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&qr->draw, &qr->draw_foreground_color, (const uint8_t *)&qr->foreground_color); ff_draw_color(&qr->draw, &qr->draw_background_color, (const uint8_t *)&qr->background_color); - ff_draw_init2(&qr->draw0, outlink->format, outlink->colorspace, outlink->color_range, FF_DRAW_PROCESS_ALPHA); + ret = ff_draw_init2(&qr->draw0, outlink->format, outlink->colorspace, outlink->color_range, FF_DRAW_PROCESS_ALPHA); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&qr->draw0, &qr->draw0_background_color, (const uint8_t *)&qr->background_color); outlink->w = qr->rendered_padded_qrcode_width; @@ -734,8 +742,12 @@ static int qrencode_config_input(AVFilterLink *inlink) qr->is_source = 0; - ff_draw_init2(&qr->draw, inlink->format, inlink->colorspace, inlink->color_range, - FF_DRAW_PROCESS_ALPHA); + ret = ff_draw_init2(&qr->draw, inlink->format, inlink->colorspace, inlink->color_range, + FF_DRAW_PROCESS_ALPHA); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } V(W) = V(main_w) = inlink->w; V(H) = V(main_h) = inlink->h; @@ -764,8 +776,12 @@ static int qrencode_config_input(AVFilterLink *inlink) PARSE_EXPR(rendered_qrcode_width); PARSE_EXPR(rendered_padded_qrcode_width); - ff_draw_init2(&qr->draw, inlink->format, inlink->colorspace, inlink->color_range, + ret = ff_draw_init2(&qr->draw, inlink->format, inlink->colorspace, inlink->color_range, FF_DRAW_PROCESS_ALPHA); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&qr->draw, &qr->draw_foreground_color, (const uint8_t *)&qr->foreground_color); ff_draw_color(&qr->draw, &qr->draw_background_color, (const uint8_t *)&qr->background_color); diff --git a/libavfilter/src_avsynctest.c b/libavfilter/src_avsynctest.c index 6f42137f49..68dffba43a 100644 --- a/libavfilter/src_avsynctest.c +++ b/libavfilter/src_avsynctest.c @@ -147,6 +147,7 @@ static av_cold int config_props(AVFilterLink *outlink) FilterLink *l = ff_filter_link(outlink); AVFilterContext *ctx = outlink->src; AVSyncTestContext *s = ctx->priv; + int ret; outlink->w = s->w; outlink->h = s->h; @@ -160,7 +161,11 @@ static av_cold int config_props(AVFilterLink *outlink) s->dir = 1; s->prev_intpart = INT64_MIN; - ff_draw_init2(&s->draw, outlink->format, outlink->colorspace, outlink->color_range, 0); + ret = ff_draw_init2(&s->draw, outlink->format, outlink->colorspace, outlink->color_range, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&s->draw, &s->fg, s->rgba[0]); ff_draw_color(&s->draw, &s->bg, s->rgba[1]); diff --git a/libavfilter/vf_datascope.c b/libavfilter/vf_datascope.c index 75dc149fbd..6efeb875a6 100644 --- a/libavfilter/vf_datascope.c +++ b/libavfilter/vf_datascope.c @@ -382,11 +382,18 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) static int config_input(AVFilterLink *inlink) { - DatascopeContext *s = inlink->dst->priv; + AVFilterContext *ctx = inlink->dst; + DatascopeContext *s = ctx->priv; + uint8_t alpha = s->opacity * 255; + int ret; s->nb_planes = av_pix_fmt_count_planes(inlink->format); - ff_draw_init2(&s->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + ret = ff_draw_init2(&s->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&s->draw, &s->white, (uint8_t[]){ 255, 255, 255, 255} ); ff_draw_color(&s->draw, &s->black, (uint8_t[]){ 0, 0, 0, alpha} ); ff_draw_color(&s->draw, &s->yellow, (uint8_t[]){ 255, 255, 0, 255} ); @@ -509,10 +516,16 @@ AVFILTER_DEFINE_CLASS(pixscope); static int pixscope_config_input(AVFilterLink *inlink) { - PixscopeContext *s = inlink->dst->priv; + AVFilterContext *ctx = inlink->dst; + PixscopeContext *s = ctx->priv; + int ret; s->nb_planes = av_pix_fmt_count_planes(inlink->format); - ff_draw_init(&s->draw, inlink->format, 0); + ret = ff_draw_init(&s->draw, inlink->format, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&s->draw, &s->dark, (uint8_t[]){ 0, 0, 0, s->o * 255} ); ff_draw_color(&s->draw, &s->black, (uint8_t[]){ 0, 0, 0, 255} ); ff_draw_color(&s->draw, &s->white, (uint8_t[]){ 255, 255, 255, 255} ); @@ -927,11 +940,17 @@ static void update_oscilloscope(AVFilterContext *ctx) static int oscilloscope_config_input(AVFilterLink *inlink) { - OscilloscopeContext *s = inlink->dst->priv; + AVFilterContext *ctx = inlink->dst; + OscilloscopeContext *s = ctx->priv; int size; + int ret; s->nb_planes = av_pix_fmt_count_planes(inlink->format); - ff_draw_init(&s->draw, inlink->format, 0); + ret = ff_draw_init(&s->draw, inlink->format, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&s->draw, &s->black, (uint8_t[]){ 0, 0, 0, 255} ); ff_draw_color(&s->draw, &s->white, (uint8_t[]){ 255, 255, 255, 255} ); ff_draw_color(&s->draw, &s->green, (uint8_t[]){ 0, 255, 0, 255} ); diff --git a/libavfilter/vf_drawtext.c b/libavfilter/vf_drawtext.c index e4662f3a45..9f5d8d9998 100644 --- a/libavfilter/vf_drawtext.c +++ b/libavfilter/vf_drawtext.c @@ -1156,7 +1156,11 @@ static int config_input(AVFilterLink *inlink) char *expr; int ret; - ff_draw_init2(&s->dc, inlink->format, inlink->colorspace, inlink->color_range, FF_DRAW_PROCESS_ALPHA); + ret = ff_draw_init2(&s->dc, inlink->format, inlink->colorspace, inlink->color_range, FF_DRAW_PROCESS_ALPHA); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&s->dc, &s->fontcolor, s->fontcolor.rgba); ff_draw_color(&s->dc, &s->shadowcolor, s->shadowcolor.rgba); ff_draw_color(&s->dc, &s->bordercolor, s->bordercolor.rgba); diff --git a/libavfilter/vf_pad.c b/libavfilter/vf_pad.c index 49fb272b24..0c7a1d2b44 100644 --- a/libavfilter/vf_pad.c +++ b/libavfilter/vf_pad.c @@ -114,7 +114,11 @@ static int config_input(AVFilterLink *inlink) double var_values[VARS_NB], res; char *expr; - ff_draw_init2(&s->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + ret = ff_draw_init2(&s->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&s->draw, &s->color, s->rgba_color); var_values[VAR_IN_W] = var_values[VAR_IW] = inlink->w; diff --git a/libavfilter/vf_shear.c b/libavfilter/vf_shear.c index f76ed1e4d5..2e558c0044 100644 --- a/libavfilter/vf_shear.c +++ b/libavfilter/vf_shear.c @@ -250,6 +250,7 @@ static int config_output(AVFilterLink *outlink) AVFilterContext *ctx = outlink->src; ShearContext *s = ctx->priv; const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(outlink->format); + int ret; s->nb_planes = av_pix_fmt_count_planes(outlink->format); s->depth = desc->comp[0].depth; @@ -260,7 +261,11 @@ static int config_output(AVFilterLink *outlink) s->planeheight[1] = s->planeheight[2] = AV_CEIL_RSHIFT(ctx->inputs[0]->h, desc->log2_chroma_h); s->planeheight[0] = s->planeheight[3] = ctx->inputs[0]->h; - ff_draw_init2(&s->draw, outlink->format, outlink->colorspace, outlink->color_range, 0); + ret = ff_draw_init2(&s->draw, outlink->format, outlink->colorspace, outlink->color_range, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&s->draw, &s->color, s->fillcolor); s->filter_slice[0] = s->depth <= 8 ? filter_slice_nn8 : filter_slice_nn16; diff --git a/libavfilter/vf_stack.c b/libavfilter/vf_stack.c index 937b87305f..fa202ee0cc 100644 --- a/libavfilter/vf_stack.c +++ b/libavfilter/vf_stack.c @@ -312,7 +312,11 @@ static int config_output(AVFilterLink *outlink) if (s->fillcolor_enable) { const AVFilterLink *inlink = ctx->inputs[0]; - ff_draw_init2(&s->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + ret = ff_draw_init2(&s->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&s->draw, &s->color, s->fillcolor); } diff --git a/libavfilter/vf_subtitles.c b/libavfilter/vf_subtitles.c index 9f573ec4ed..cf23b7822a 100644 --- a/libavfilter/vf_subtitles.c +++ b/libavfilter/vf_subtitles.c @@ -182,12 +182,18 @@ static int query_formats(const AVFilterContext *ctx, static int config_input(AVFilterLink *inlink) { - AssContext *ass = inlink->dst->priv; + AVFilterContext *ctx = inlink->dst; + AssContext *ass = ctx->priv; + int ret; - ff_draw_init2(&ass->draw, inlink->format, - ass_get_color_space(ass->track->YCbCrMatrix, inlink->colorspace), - ass_get_color_range(ass->track->YCbCrMatrix, inlink->color_range), - ass->alpha ? FF_DRAW_PROCESS_ALPHA : 0); + ret = ff_draw_init2(&ass->draw, inlink->format, + ass_get_color_space(ass->track->YCbCrMatrix, inlink->colorspace), + ass_get_color_range(ass->track->YCbCrMatrix, inlink->color_range), + ass->alpha ? FF_DRAW_PROCESS_ALPHA : 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ass_set_frame_size (ass->renderer, inlink->w, inlink->h); if (ass->original_w && ass->original_h) { diff --git a/libavfilter/vf_tile.c b/libavfilter/vf_tile.c index 9305123b33..7f2f212c4a 100644 --- a/libavfilter/vf_tile.c +++ b/libavfilter/vf_tile.c @@ -128,6 +128,7 @@ static int config_props(AVFilterLink *outlink) FilterLink *ol = ff_filter_link(outlink); const unsigned total_margin_w = (tile->w - 1) * tile->padding + 2*tile->margin; const unsigned total_margin_h = (tile->h - 1) * tile->padding + 2*tile->margin; + int ret; if (inlink->w > (INT_MAX - total_margin_w) / tile->w) { av_log(ctx, AV_LOG_ERROR, "Total width %ux%u is too much.\n", @@ -143,7 +144,11 @@ static int config_props(AVFilterLink *outlink) outlink->h = tile->h * inlink->h + total_margin_h; outlink->sample_aspect_ratio = inlink->sample_aspect_ratio; ol->frame_rate = av_mul_q(il->frame_rate, av_make_q(1, tile->nb_frames - tile->overlap)); - ff_draw_init2(&tile->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + ret = ff_draw_init2(&tile->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&tile->draw, &tile->blank, tile->rgba_color); return 0; diff --git a/libavfilter/vf_tinterlace.c b/libavfilter/vf_tinterlace.c index de7cd88103..f013891f3e 100644 --- a/libavfilter/vf_tinterlace.c +++ b/libavfilter/vf_tinterlace.c @@ -228,7 +228,11 @@ static int config_out_props(AVFilterLink *outlink) if (tinterlace->mode == MODE_PAD) { uint8_t black[4] = { 0, 0, 0, 16 }; - ff_draw_init2(&tinterlace->draw, outlink->format, outlink->colorspace, outlink->color_range, 0); + ret = ff_draw_init2(&tinterlace->draw, outlink->format, outlink->colorspace, outlink->color_range, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&tinterlace->draw, &tinterlace->color, black); /* limited range */ if (!ff_fmt_is_in(outlink->format, full_scale_yuvj_pix_fmts)) { diff --git a/libavfilter/vf_tpad.c b/libavfilter/vf_tpad.c index 7ba6fe72bf..f498bf4a3e 100644 --- a/libavfilter/vf_tpad.c +++ b/libavfilter/vf_tpad.c @@ -206,9 +206,14 @@ static int config_input(AVFilterLink *inlink) AVFilterContext *ctx = inlink->dst; FilterLink *l = ff_filter_link(inlink); TPadContext *s = ctx->priv; + int ret; if (needs_drawing(s)) { - ff_draw_init2(&s->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + ret = ff_draw_init2(&s->draw, inlink->format, inlink->colorspace, inlink->color_range, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } ff_draw_color(&s->draw, &s->color, s->rgba_color); } diff --git a/libavfilter/vsrc_testsrc.c b/libavfilter/vsrc_testsrc.c index c842cacceb..6be274cc90 100644 --- a/libavfilter/vsrc_testsrc.c +++ b/libavfilter/vsrc_testsrc.c @@ -262,8 +262,13 @@ static int color_config_props(AVFilterLink *inlink) TestSourceContext *test = ctx->priv; int ret; - ff_draw_init2(&test->draw, inlink->format, inlink->colorspace, - inlink->color_range, 0); + ret = ff_draw_init2(&test->draw, inlink->format, inlink->colorspace, + inlink->color_range, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Failed to initialize FFDrawContext\n"); + return ret; + } + ff_draw_color(&test->draw, &test->color, test->color_rgba); if (av_image_check_size(test->w, test->h, 0, ctx) < 0) -- 2.47.1 --000000000000a54fa5062e9ea2fc Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --000000000000a54fa5062e9ea2fc--