From: ffmpegagent <ffmpegagent@gmail.com>
To: ffmpeg-devel@ffmpeg.org
Cc: Michael Niedermayer <michael@niedermayer.cc>,
softworkz <softworkz@hotmail.com>
Subject: [FFmpeg-devel] [PATCH v3 00/11] libavformat/asf: fix handling of byte array length values
Date: Sun, 08 May 2022 03:01:11 +0000
Message-ID: <pull.12.v3.ffstaging.FFmpeg.1651978882.ffmpegagent@gmail.com> (raw)
In-Reply-To: <pull.12.v2.ffstaging.FFmpeg.1651916204.ffmpegagent@gmail.com>
The spec allows attachment sizes of up to UINT32_MAX while we can handle
only sizes up to INT32_MAX (in downstream code)
The debug.assert in get_tag didn't really address this, and truncating the
value_len in calling methods cannot be used because the length value is
required in order to continue parsing. This adds a check with log message in
ff_asf_handle_byte_array to handle those (rare) cases.
v2: Rebased & PING v3: Adjustments suggested by Michael
softworkz (11):
libavformat/asf: fix handling of byte array length values
libavformat/asfdec: fix get_value return type and add checks for
libavformat/asfdec: fix type of value_len
libavformat/asfdec: fixing get_tag
libavformat/asfdec: implement parsing of GUID values
libavformat/asfdec: remove unused parameters
libavformat/asfdec: fix macro definition and use
libavformat/asfdec: remove variable redefinition in inner scope
libavformat/asfdec: ensure variables are initialized
libavformat/asfdec: fix parameter type in asf_read_stream_propertie()
libavformat/asfdec: fix variable types and add checks for unsupported
values
libavformat/asf.c | 8 +-
libavformat/asf.h | 2 +-
libavformat/asfdec_f.c | 368 ++++++++++++++++++++++++++---------------
3 files changed, 244 insertions(+), 134 deletions(-)
base-commit: f1c19867d72a14699277175101b2bcf1e333af88
Published-As: https://github.com/ffstaging/FFmpeg/releases/tag/pr-ffstaging-12%2Fsoftworkz%2Fmaster-upstream_asf_4-v3
Fetch-It-Via: git fetch https://github.com/ffstaging/FFmpeg pr-ffstaging-12/softworkz/master-upstream_asf_4-v3
Pull-Request: https://github.com/ffstaging/FFmpeg/pull/12
Range-diff vs v2:
1: 0056a93a34 ! 1: b5c56bf5d0 libavformat/asf: fix handling of byte array length values
@@ libavformat/asf.c: static int get_id3_tag(AVFormatContext *s, int len)
+ }
+
if (!strcmp(name, "WM/Picture")) // handle cover art
-- return asf_read_picture(s, val_len);
-+ return asf_read_picture(s, (int)val_len);
+ return asf_read_picture(s, val_len);
else if (!strcmp(name, "ID3")) // handle ID3 tag
-- return get_id3_tag(s, val_len);
-+ return get_id3_tag(s, (int)val_len);
+ return get_id3_tag(s, val_len);
-+ av_log(s, AV_LOG_VERBOSE, "Unsupported byte array in tag %s.\n", name);
++ av_log(s, AV_LOG_DEBUG, "Unsupported byte array in tag %s.\n", name);
return 1;
}
2: a35b7c87d4 ! 2: e6aa0fb7f3 libavformat/asfdec: fix get_value return type and add checks for
@@ libavformat/asfdec_f.c: static int asf_probe(const AVProbeData *pd)
{
switch (type) {
case ASF_BOOL:
+@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size)
+ {
+ AVIOContext *pb = s->pb;
+ ASFContext *asf = s->priv_data;
++ uint64_t dar_num = 0;
++ uint64_t dar_den = 0;
+ int desc_count, i, ret;
+
+ desc_count = avio_rl16(pb);
@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size)
/* My sample has that stream set to 0 maybe that mean the container.
* ASF stream count starts at 1. I am using 0 to the container value
@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s,
- else if (!strcmp(name, "AspectRatioY"))
- asf->dar[0].den = get_value(s->pb, value_type, 32);
+ if (!strcmp(name, "AspectRatioX")) {
-+ const uint64_t value = get_value(s->pb, value_type, 32);
-+ if (value > INT32_MAX) {
-+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", value);
++ dar_num = get_value(s->pb, value_type, 32);
++ if (dar_num > INT64_MAX) {
++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num);
+ return AVERROR(ENOTSUP);
+ }
-+ asf->dar[0].num = (int)value;
+ }
+ else if (!strcmp(name, "AspectRatioY")) {
-+ const uint64_t value = get_value(s->pb, value_type, 32);
-+ if (value > INT32_MAX) {
-+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", value);
++ dar_den = get_value(s->pb, value_type, 32);
++ if (dar_den > INT64_MAX) {
++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den);
+ return AVERROR(ENOTSUP);
+ }
-+ asf->dar[0].den = (int)value;
+ }
else
get_tag(s, name, value_type, value_len, 32);
}
+
++ if (dar_num && dar_den)
++ av_reduce(&asf->dar[0].num, &asf->dar[0].den, dar_num, dar_den, INT_MAX);
++
+ return 0;
+ }
+
+@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size)
+ {
+ AVIOContext *pb = s->pb;
+ ASFContext *asf = s->priv_data;
++ uint64_t dar_num[128] = {0};
++ uint64_t dar_den[128] = {0};
+ int n, stream_num, name_len_utf16, name_len_utf8, value_len;
+ int ret, i;
+ n = avio_rl16(pb);
@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size)
+ av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n",
i, stream_num, name_len_utf16, value_type, value_len, name);
- if (!strcmp(name, "AspectRatioX")){
+- if (!strcmp(name, "AspectRatioX")){
- int aspect_x = get_value(s->pb, value_type, 16);
-+ const uint64_t aspect_x = get_value(s->pb, value_type, 16);
-+ if (aspect_x > INT32_MAX) {
-+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", aspect_x);
-+ return AVERROR(ENOTSUP);
-+ }
- if(stream_num < 128)
+- if(stream_num < 128)
- asf->dar[stream_num].num = aspect_x;
-+ asf->dar[stream_num].num = (int)aspect_x;
- } else if(!strcmp(name, "AspectRatioY")){
+- } else if(!strcmp(name, "AspectRatioY")){
- int aspect_y = get_value(s->pb, value_type, 16);
-+ const uint64_t aspect_y = get_value(s->pb, value_type, 16);
-+ if (aspect_y > INT32_MAX) {
-+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", aspect_y);
+- if(stream_num < 128)
+- asf->dar[stream_num].den = aspect_y;
+- } else {
++ if (!strcmp(name, "AspectRatioX") && stream_num < 128) {
++ dar_num[stream_num] = get_value(s->pb, value_type, 16);
++ if (dar_num[stream_num] > INT64_MAX) {
++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num[stream_num]);
+ return AVERROR(ENOTSUP);
+ }
- if(stream_num < 128)
-- asf->dar[stream_num].den = aspect_y;
-+ asf->dar[stream_num].den = (int)aspect_y;
- } else {
++ }
++ else if (!strcmp(name, "AspectRatioY") && stream_num < 128) {
++ dar_den[stream_num] = get_value(s->pb, value_type, 16);
++ if (dar_den[stream_num] > INT64_MAX) {
++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den[stream_num]);
++ return AVERROR(ENOTSUP);
++ }
++ } else
get_tag(s, name, value_type, value_len, 16);
++
++
++ if (stream_num < 128 && dar_num[stream_num] && dar_den[stream_num]) {
++ av_reduce(&asf->dar[stream_num].num, &asf->dar[stream_num].den, dar_num[stream_num], dar_den[stream_num], INT_MAX);
++ dar_num[stream_num] = 0;
++ dar_den[stream_num] = 0;
}
++
+ av_freep(&name);
+ }
+
3: b8039dc4cf ! 3: b84474d729 libavformat/asfdec: fix type of value_len
@@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex
len1 = avio_rl16(pb);
len2 = avio_rl16(pb);
@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size)
- {
- AVIOContext *pb = s->pb;
ASFContext *asf = s->priv_data;
+ uint64_t dar_num[128] = {0};
+ uint64_t dar_den[128] = {0};
- int n, stream_num, name_len_utf16, name_len_utf8, value_len;
+ int n, name_len_utf8;
+ uint16_t stream_num, name_len_utf16, value_type;
4: 6e19df6e89 = 4: a54feb51a1 libavformat/asfdec: fixing get_tag
5: 0f3c417efe = 5: e14beb2c15 libavformat/asfdec: implement parsing of GUID values
6: 3bee11e40f = 6: 06062da88b libavformat/asfdec: remove unused parameters
7: ca9bbc79de = 7: 273823a5b4 libavformat/asfdec: fix macro definition and use
8: 238290bbce = 8: aaa37aca21 libavformat/asfdec: remove variable redefinition in inner scope
9: 654e44d526 = 9: 6aedb68b76 libavformat/asfdec: ensure variables are initialized
10: d461f039d2 = 10: 28ebbe7289 libavformat/asfdec: fix parameter type in asf_read_stream_propertie()
11: f606f322bb ! 11: bbeee5f2da libavformat/asfdec: fix variable types and add checks for unsupported values
@@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex
if (stream_num < 128 && i < FF_ARRAY_ELEMS(asf->streams[stream_num].payload)) {
ASFPayload *p = &asf->streams[stream_num].payload[i];
@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s)
- {
- AVIOContext *pb = s->pb;
ASFContext *asf = s->priv_data;
+ uint64_t dar_num = 0;
+ uint64_t dar_den = 0;
- int desc_count, i, ret;
+ uint16_t desc_count, i;
+ int ret;
@@ libavformat/asfdec_f.c: static int asf_read_language_list(AVFormatContext *s)
av_strlcpy(asf->stream_languages[j], lang,
sizeof(*asf->stream_languages));
@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s)
- {
- AVIOContext *pb = s->pb;
ASFContext *asf = s->priv_data;
+ uint64_t dar_num[128] = {0};
+ uint64_t dar_den[128] = {0};
- int n, name_len_utf8;
- uint16_t stream_num, name_len_utf16, value_type;
+ int name_len_utf8;
--
ffmpeg-codebot
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
next prev parent reply other threads:[~2022-05-08 3:01 UTC|newest]
Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-22 15:13 [PATCH " ffmpegagent
2021-12-22 15:13 ` [PATCH 01/11] " ffmpegagent
2021-12-22 15:13 ` [PATCH 02/11] libavformat/asfdec: fix get_value return type and add checks for ffmpegagent
2021-12-22 15:13 ` [PATCH 03/11] libavformat/asfdec: fix type of value_len ffmpegagent
2021-12-22 15:13 ` [PATCH 04/11] libavformat/asfdec: fixing get_tag ffmpegagent
2021-12-22 15:13 ` [PATCH 05/11] libavformat/asfdec: implement parsing of GUID values ffmpegagent
2021-12-22 15:13 ` [PATCH 06/11] libavformat/asfdec: remove unused parameters ffmpegagent
2021-12-22 18:16 ` Soft Works
2021-12-22 15:13 ` [PATCH 07/11] libavformat/asfdec: fix macro definition and use ffmpegagent
2021-12-22 16:23 ` Soft Works
2021-12-22 15:13 ` [PATCH 08/11] libavformat/asfdec: remove variable redefinition in inner scope ffmpegagent
2021-12-22 15:13 ` [PATCH 09/11] libavformat/asfdec: ensure variables are initialized ffmpegagent
2021-12-22 15:13 ` [PATCH 10/11] libavformat/asfdec: fix parameter type in asf_read_stream_propertie() ffmpegagent
2021-12-22 15:13 ` [PATCH 11/11] libavformat/asfdec: fix variable types and add checks for unsupported values ffmpegagent
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 00/11] libavformat/asf: fix handling of byte array length values ffmpegagent
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 01/11] " softworkz
2022-05-07 18:48 ` Michael Niedermayer
2022-05-08 2:27 ` Soft Works
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 02/11] libavformat/asfdec: fix get_value return type and add checks for softworkz
2022-05-07 18:57 ` Michael Niedermayer
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 03/11] libavformat/asfdec: fix type of value_len softworkz
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 04/11] libavformat/asfdec: fixing get_tag softworkz
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 05/11] libavformat/asfdec: implement parsing of GUID values softworkz
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 06/11] libavformat/asfdec: remove unused parameters softworkz
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 07/11] libavformat/asfdec: fix macro definition and use softworkz
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 08/11] libavformat/asfdec: remove variable redefinition in inner scope softworkz
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 09/11] libavformat/asfdec: ensure variables are initialized softworkz
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 10/11] libavformat/asfdec: fix parameter type in asf_read_stream_propertie() softworkz
2022-05-07 9:36 ` [FFmpeg-devel] [PATCH v2 11/11] libavformat/asfdec: fix variable types and add checks for unsupported values softworkz
2022-05-08 3:01 ` ffmpegagent [this message]
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 01/11] libavformat/asf: fix handling of byte array length values softworkz
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 02/11] libavformat/asfdec: fix get_value return type and add checks for softworkz
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 03/11] libavformat/asfdec: fix type of value_len softworkz
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 04/11] libavformat/asfdec: fixing get_tag softworkz
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 05/11] libavformat/asfdec: implement parsing of GUID values softworkz
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 06/11] libavformat/asfdec: remove unused parameters softworkz
2022-05-08 18:50 ` Michael Niedermayer
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 07/11] libavformat/asfdec: fix macro definition and use softworkz
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 08/11] libavformat/asfdec: remove variable redefinition in inner scope softworkz
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 09/11] libavformat/asfdec: ensure variables are initialized softworkz
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 10/11] libavformat/asfdec: fix parameter type in asf_read_stream_propertie() softworkz
2022-05-08 3:01 ` [FFmpeg-devel] [PATCH v3 11/11] libavformat/asfdec: fix variable types and add checks for unsupported values softworkz
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 00/10] libavformat/asf: fix handling of byte array length values ffmpegagent
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 01/10] " softworkz
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 02/10] libavformat/asfdec: fix get_value return type and add checks for softworkz
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 03/10] libavformat/asfdec: fix type of value_len softworkz
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 04/10] libavformat/asfdec: fixing get_tag softworkz
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 05/10] libavformat/asfdec: implement parsing of GUID values softworkz
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 06/10] libavformat/asfdec: fix macro definition and use softworkz
2022-05-15 18:12 ` Andreas Rheinhardt
2022-05-15 22:51 ` Soft Works
2022-05-16 8:48 ` Andreas Rheinhardt
2022-05-16 22:03 ` Soft Works
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 07/10] libavformat/asfdec: remove variable redefinition in inner scope softworkz
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 08/10] libavformat/asfdec: ensure variables are initialized softworkz
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 09/10] libavformat/asfdec: fix parameter type in asf_read_stream_propertie() softworkz
2022-05-14 20:55 ` [FFmpeg-devel] [PATCH v4 10/10] libavformat/asfdec: fix variable types and add checks for unsupported values softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 00/10] libavformat/asf: fix handling of byte array length values ffmpegagent
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 01/10] " softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 02/10] libavformat/asfdec: fix get_value return type and add checks for softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 03/10] libavformat/asfdec: fix type of value_len softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 04/10] libavformat/asfdec: fixing get_tag softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 05/10] libavformat/asfdec: implement parsing of GUID values softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 06/10] libavformat/asfdec: avoid clang warnings softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 07/10] libavformat/asfdec: remove variable redefinition in inner scope softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 08/10] libavformat/asfdec: ensure variables are initialized softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 09/10] libavformat/asfdec: fix parameter type in asf_read_stream_propertie() softworkz
2022-05-21 5:21 ` [FFmpeg-devel] [PATCH v5 10/10] libavformat/asfdec: fix variable types and add checks for unsupported values softworkz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=pull.12.v3.ffstaging.FFmpeg.1651978882.ffmpegagent@gmail.com \
--to=ffmpegagent@gmail.com \
--cc=ffmpeg-devel@ffmpeg.org \
--cc=michael@niedermayer.cc \
--cc=softworkz@hotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git