From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id ED5694311A for ; Sat, 21 May 2022 05:22:09 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id F307968B4D5; Sat, 21 May 2022 08:21:51 +0300 (EEST) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 4993768AAC1 for ; Sat, 21 May 2022 08:21:45 +0300 (EEST) Received: by mail-pj1-f48.google.com with SMTP id v5-20020a17090a7c0500b001df84fa82f8so9349756pjf.5 for ; Fri, 20 May 2022 22:21:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:message-id:in-reply-to:references:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=e9kAy1hNhj5Sc7aTm650SFJdxjeG7UpvPDKX1g2Yhyg=; b=cqeQk3nag4yc+MfijCRcf24YYZuqVwM5bJF8sly399P88mz6quRh2HxerDSVmvetAQ T5788be576MRLxttdu/ZqkFiyur/06M6EMmw/EJeeJ2CckE0uP/4Tpx7S98rMg6CpqX6 vStBgB+EP2vYOjekvCrtAxvrEhPYuSGntKR+Q4RAQVqyeoj/Z0z/krD5bFC4xYkJtYRt sV1HNqwwLkQ5S3lnwMJ2WrlEii2ZN9DaWl3juSQNhtrZTxumjtekICwcd26xnfptwbej 8MGIdc8pCexowAwh1IWThwsoi+fjwsofBwoT/9mqHmqeEmiBLQTGkOx7ksp+q6lZojR7 YQBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:message-id:in-reply-to:references:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=e9kAy1hNhj5Sc7aTm650SFJdxjeG7UpvPDKX1g2Yhyg=; b=vlNVtxsmNsfmLHekyrCADIa32uY9EdqAWYW0OMsgy8keInegF68limF2U5+P/tD+gV DP2MyhcwtTcYkp4TWhUU5/wInn4bFzE6C9uRdQ+4UjU1+9bcP8CCIk1kr/n5gaSarfHQ ZbzfF6kZycgEWvpov1L3Rqu4kMl3+Didj5rkVSwOi70DQgJ6U2WhUj+3mlZyQHsJ9qzB 9hUb9ZWKU8t2T9tc08D0ZlHA+bQTUV/KvjIgWgW/YfEhJtTvoOMYo06zA/PhoDFIkKoW 7Ah/tnA86CFaXmvH4BnNsq4sRuiqGVWDOUAL1CIVozB7u8j2cNrYiFADNV8qMGrpm/cE VuPg== X-Gm-Message-State: AOAM531buogMBEWInpiW2bjO9HnLKV4Mb/i+Gtg+xzsC1TS86qHuno7c 0Pb6gNjV6D82+UG5sOvxImtNDMToWbo9hA== X-Google-Smtp-Source: ABdhPJzKqzZyZM1JVikyiZgwbr1v9E6kRPyYT/0jC42t4NVmDQoS0wJd/KjwdTQT5d459+KTCRZfXw== X-Received: by 2002:a17:902:7c83:b0:162:64e:8c19 with SMTP id y3-20020a1709027c8300b00162064e8c19mr1514044pll.9.1653110503465; Fri, 20 May 2022 22:21:43 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id t12-20020a170902e84c00b0015e8d4eb244sm149370plg.142.2022.05.20.22.21.42 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 May 2022 22:21:43 -0700 (PDT) From: softworkz X-Google-Original-From: softworkz Message-Id: In-Reply-To: References: Date: Sat, 21 May 2022 05:21:32 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v5 02/10] libavformat/asfdec: fix get_value return type and add checks for X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Michael Niedermayer , softworkz , Andreas Rheinhardt Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: From: softworkz unsupported values get_value had a return type of int, which means that reading QWORDS (case 4) was broken due to truncation of the result from avio_rl64(). Signed-off-by: softworkz --- libavformat/asfdec_f.c | 57 +++++++++++++++++++++++++++++++----------- 1 file changed, 43 insertions(+), 14 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index 4770a812db..c7c4ba55d6 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -203,7 +203,7 @@ static int asf_probe(const AVProbeData *pd) /* size of type 2 (BOOL) is 32bit for "Extended Content Description Object" * but 16 bit for "Metadata Object" and "Metadata Library Object" */ -static int get_value(AVIOContext *pb, int type, int type2_size) +static uint64_t get_value(AVIOContext *pb, int type, int type2_size) { switch (type) { case ASF_BOOL: @@ -549,6 +549,8 @@ static int asf_read_ext_content_desc(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; + uint64_t dar_num = 0; + uint64_t dar_den = 0; int desc_count, i, ret; desc_count = avio_rl16(pb); @@ -568,14 +570,27 @@ static int asf_read_ext_content_desc(AVFormatContext *s) /* My sample has that stream set to 0 maybe that mean the container. * ASF stream count starts at 1. I am using 0 to the container value * since it's unused. */ - if (!strcmp(name, "AspectRatioX")) - asf->dar[0].num = get_value(s->pb, value_type, 32); - else if (!strcmp(name, "AspectRatioY")) - asf->dar[0].den = get_value(s->pb, value_type, 32); + if (!strcmp(name, "AspectRatioX")) { + dar_num = get_value(s->pb, value_type, 32); + if (dar_num > INT64_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num); + return AVERROR(ENOTSUP); + } + } + else if (!strcmp(name, "AspectRatioY")) { + dar_den = get_value(s->pb, value_type, 32); + if (dar_den > INT64_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den); + return AVERROR(ENOTSUP); + } + } else get_tag(s, name, value_type, value_len, 32); } + if (dar_num && dar_den) + av_reduce(&asf->dar[0].num, &asf->dar[0].den, dar_num, dar_den, INT_MAX); + return 0; } @@ -603,6 +618,8 @@ static int asf_read_metadata(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; + uint64_t dar_num[128] = {0}; + uint64_t dar_den[128] = {0}; int n, stream_num, name_len_utf16, name_len_utf8, value_len; int ret, i; n = avio_rl16(pb); @@ -630,17 +647,29 @@ static int asf_read_metadata(AVFormatContext *s) av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n", i, stream_num, name_len_utf16, value_type, value_len, name); - if (!strcmp(name, "AspectRatioX")){ - int aspect_x = get_value(s->pb, value_type, 16); - if(stream_num < 128) - asf->dar[stream_num].num = aspect_x; - } else if(!strcmp(name, "AspectRatioY")){ - int aspect_y = get_value(s->pb, value_type, 16); - if(stream_num < 128) - asf->dar[stream_num].den = aspect_y; - } else { + if (!strcmp(name, "AspectRatioX") && stream_num < 128) { + dar_num[stream_num] = get_value(s->pb, value_type, 16); + if (dar_num[stream_num] > INT64_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num[stream_num]); + return AVERROR(ENOTSUP); + } + } + else if (!strcmp(name, "AspectRatioY") && stream_num < 128) { + dar_den[stream_num] = get_value(s->pb, value_type, 16); + if (dar_den[stream_num] > INT64_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den[stream_num]); + return AVERROR(ENOTSUP); + } + } else get_tag(s, name, value_type, value_len, 16); + + + if (stream_num < 128 && dar_num[stream_num] && dar_den[stream_num]) { + av_reduce(&asf->dar[stream_num].num, &asf->dar[stream_num].den, dar_num[stream_num], dar_den[stream_num], INT_MAX); + dar_num[stream_num] = 0; + dar_den[stream_num] = 0; } + av_freep(&name); } -- ffmpeg-codebot _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".