From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by master.gitmailbox.com (Postfix) with ESMTPS id A055C406D5 for ; Wed, 22 Dec 2021 15:13:53 +0000 (UTC) Received: by mail-pj1-f41.google.com with SMTP id v13-20020a17090a088d00b001b0e3a74cf7so4304492pjc.1 for ; Wed, 22 Dec 2021 07:13:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=0+jzSEEt5WZFULr+6KdMyp9C+x5eb5PKQowpO7kNugk=; b=TK6ChUT0sgAK/HF4rqzKVAReiVaPgnTCNtzSmd/hO0UqhMfL2SwnRRfzRRDQOD4jGr 9LYpvC1jYIeMNDgkonxIezdj0N8iSjAf3YyKSSvj3kQzQRBcmtO7wlZJwXwLXDYlpTg4 +c3doZedUTynbBOcy6FrZHXwFEbiIiyo+F66t3nlG3ubRaAbkuUicz1SGwtf4q/vWCTS ZiUXwktXiGjd91gozFFeQQzXE//qM9JeTHCMI7xm4nNIz+B4J7jByVGnBNru4ID3TUOU 04Z+o0k5+Ru9fCaMNFLikhAa1hBcy4jxSrF7bcS64qFUO8bxXwhJuzSm9RC2dOz7sSZH o+WQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=0+jzSEEt5WZFULr+6KdMyp9C+x5eb5PKQowpO7kNugk=; b=EUjAdu+eCn2bBrHyRpd+OtHLPZbne8Fya7qrXUCBWmy8Qva6u7ftezJjb8Q4nbqOKs AeqfO1bvLix4WG3EdEoUbrzJS0H98hJbdWQ1NtDGIXM0piWcm/3kuJXgdLcub+IbMYBZ zt1yoW6+eJK6xJ9PK+5lPErEcpIvcly9yfhunKSasm2FAfpDBTcbrAERwrZ32q0+bVFS TE1WC4ffMtaFG2MJpWPn9Bww2iQNYCfhFMyHX9tdPx29xVZvUtSaO4eRmo7eSADANQJ3 AJ8ybOCnzP9yKVtdPfeBNbI/vy6tPMZdda10WCKXLN7wSvKMwZvW1+5iw4KUeCNZaTcK gmOA== X-Gm-Message-State: AOAM533ZFrOB/v78f3VwgTXhNKfhQStcwFoR+kotyLwlprGHOF0Vdj+j gwoj4LJVgSSO9Wr9GFXOWUen/U5LnAJzv3EP X-Google-Smtp-Source: ABdhPJxTUGO+n8pLYt4hXKHgRF0rDMjmrhDYxvQD96Sf8MH36ivGy8mHnGHbs7c3C3rei43JeVj6wQ== X-Received: by 2002:a17:90b:4a51:: with SMTP id lb17mr1855851pjb.118.1640186033235; Wed, 22 Dec 2021 07:13:53 -0800 (PST) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id a3sm3186677pfv.47.2021.12.22.07.13.52 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Dec 2021 07:13:52 -0800 (PST) Message-Id: In-Reply-To: References: From: ffmpegagent Date: Wed, 22 Dec 2021 15:13:41 +0000 Subject: [PATCH 02/11] libavformat/asfdec: fix get_value return type and add checks for Fcc: Sent Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MIME-Version: 1.0 To: ffmpegdev@gitmailbox.com Cc: softworkz , softworkz Archived-At: List-Archive: List-Post: From: softworkz unsupported values get_value had a return type of int, which means that reading QWORDS (case 4) was broken due to truncation of the result from avio_rl64(). Signed-off-by: softworkz --- libavformat/asfdec_f.c | 38 +++++++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index a8f36ed286..d31e1d581d 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -202,7 +202,7 @@ static int asf_probe(const AVProbeData *pd) /* size of type 2 (BOOL) is 32bit for "Extended Content Description Object" * but 16 bit for "Metadata Object" and "Metadata Library Object" */ -static int get_value(AVIOContext *pb, int type, int type2_size) +static uint64_t get_value(AVIOContext *pb, int type, int type2_size) { switch (type) { case ASF_BOOL: @@ -567,10 +567,22 @@ static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) /* My sample has that stream set to 0 maybe that mean the container. * ASF stream count starts at 1. I am using 0 to the container value * since it's unused. */ - if (!strcmp(name, "AspectRatioX")) - asf->dar[0].num = get_value(s->pb, value_type, 32); - else if (!strcmp(name, "AspectRatioY")) - asf->dar[0].den = get_value(s->pb, value_type, 32); + if (!strcmp(name, "AspectRatioX")) { + const uint64_t value = get_value(s->pb, value_type, 32); + if (value > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", value); + return AVERROR(ENOTSUP); + } + asf->dar[0].num = (int)value; + } + else if (!strcmp(name, "AspectRatioY")) { + const uint64_t value = get_value(s->pb, value_type, 32); + if (value > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", value); + return AVERROR(ENOTSUP); + } + asf->dar[0].den = (int)value; + } else get_tag(s, name, value_type, value_len, 32); } @@ -630,13 +642,21 @@ static int asf_read_metadata(AVFormatContext *s, int64_t size) i, stream_num, name_len_utf16, value_type, value_len, name); if (!strcmp(name, "AspectRatioX")){ - int aspect_x = get_value(s->pb, value_type, 16); + const uint64_t aspect_x = get_value(s->pb, value_type, 16); + if (aspect_x > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", aspect_x); + return AVERROR(ENOTSUP); + } if(stream_num < 128) - asf->dar[stream_num].num = aspect_x; + asf->dar[stream_num].num = (int)aspect_x; } else if(!strcmp(name, "AspectRatioY")){ - int aspect_y = get_value(s->pb, value_type, 16); + const uint64_t aspect_y = get_value(s->pb, value_type, 16); + if (aspect_y > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", aspect_y); + return AVERROR(ENOTSUP); + } if(stream_num < 128) - asf->dar[stream_num].den = aspect_y; + asf->dar[stream_num].den = (int)aspect_y; } else { get_tag(s, name, value_type, value_len, 16); } -- gitgitgadget