Re: [FFmpeg-devel] [PATCH 1/2] avcodec/flac_parser: Assert that we do not overrun the link_penalty array

From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
To: ffmpeg-devel@ffmpeg.org
Subject: Re: [FFmpeg-devel] [PATCH 1/2] avcodec/flac_parser: Assert that we do not overrun the link_penalty array
Date: Mon, 13 May 2024 22:45:16 +0200
Message-ID: <GV1P250MB0737FB1A59032C33162D818B8FE22@GV1P250MB0737.EURP250.PROD.OUTLOOK.COM> (raw)
In-Reply-To: <20240504235200.2875183-1-michael@niedermayer.cc>

Michael Niedermayer:
> Fixes: CID1454676 Out-of-bounds read
> 
> Sponsored-by: Sovereign Tech Fund
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/flac_parser.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/libavcodec/flac_parser.c b/libavcodec/flac_parser.c
> index 47904d515a6..d9c47801f83 100644
> --- a/libavcodec/flac_parser.c
> +++ b/libavcodec/flac_parser.c
> @@ -518,6 +518,8 @@ static int check_header_mismatch(FLACParseContext  *fpc,
>          for (i = 0; i < FLAC_MAX_SEQUENTIAL_HEADERS && curr != child; i++)
>              curr = curr->next;
>  
> +        av_assert0(i < FLAC_MAX_SEQUENTIAL_HEADERS);
> +
>          if (header->link_penalty[i] < FLAC_HEADER_CRC_FAIL_PENALTY ||
>              header->link_penalty[i] == FLAC_HEADER_NOT_PENALIZED_YET) {
>              FLACHeaderMarker *start, *end;

If this is only supposed to mark an issue as invalid for the sanitizer,
why are you adding an av_assert0 instead of av_assert1 here (and in
other patches)?

- Andreas

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".