From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id EC41941075 for ; Sat, 14 May 2022 20:55:37 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 36FDA68B476; Sat, 14 May 2022 23:55:34 +0300 (EEST) Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 2AEC968B192 for ; Sat, 14 May 2022 23:55:26 +0300 (EEST) Received: by mail-pj1-f53.google.com with SMTP id ev18so321280pjb.4 for ; Sat, 14 May 2022 13:55:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=+GoWUtc/K8NdATrUbh2gyGZsZqAc5yU+j4p2VkOL2PI=; b=TlS7qeDG3lkVhlfQqDC+yh7FpO4TKpDcKKP4FBrQqKnefPL0J0gOXjUUgqm2WnWlj6 CNKEisPs+icZQCsiFCREMWmD8dMTDk7mbUjRHY+jf5I93VrXMN0/lYS69Iz05tZVNUzC BrE9HzqfHyEf0DUAHdM0dGLOcUu/fYHTT+z+aAqSbSs0he0R3tGCRBP3GyCsB7Wry5tU /8pgTdoDHn/V/8p07wh8pEkoPQVUZZ2R6QuHfRsA5P+7Re1At+swJ3Rj5PN2NRhMHqFE 4rzU5QUOhEJ6YT7cbfB4eY9F4LmXMjKBYhYjgX+J3onjeBf3NFYvzCRnD++rgSMh9iQX cg3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=+GoWUtc/K8NdATrUbh2gyGZsZqAc5yU+j4p2VkOL2PI=; b=zdkHYZBW9yfRIoTWicaubmKrJ7VwIUMM4Yc4dmKOMgxSrlncvIyJto53guZgA8nqaq AhI7mWhUv2xGCalWY8lQK5nEmYyve6OcICxsIKgwCiMbeKpq11S2OOhvAMHyssSUVW1R vM1bLd2+YuUBl2IzDVB6wcOcIvkjuPPMdtsBdvO3ts1gosiZBH9UXyfwJgIElx0Wer3Q 3QmiyFMUX9zhKpFaJE2ZeEqeeysiWqwlEMZmvTW3p7MW/onl5gt7D78ZVXuklK5bdS+L +IOEZbT9GJx5kmKg96x424OWaSYcUChC2+eMnLutbHATlFERPo0ysu1ijPqPY5WLOm5g 4Qew== X-Gm-Message-State: AOAM532L25Tm3CCFF9D2Oid5bb+SHMICunDAnJrvFrUL5DVlHXsBjxnl lAqB+adLlY1rk/3x5+l7mFJLfWybIDEzzQ== X-Google-Smtp-Source: ABdhPJyNYfPCqBZNxkYJfWmXR8ZYI+skvgxMLmk4MCHwlYMV5Y9kGB2WCgxMn7wqJI0bWmwAurI+Lw== X-Received: by 2002:a17:90a:ce13:b0:1d9:acbe:7ede with SMTP id f19-20020a17090ace1300b001d9acbe7edemr22812258pju.16.1652561723999; Sat, 14 May 2022 13:55:23 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id d17-20020a170902aa9100b0015e8d4eb218sm4119363plr.98.2022.05.14.13.55.22 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 14 May 2022 13:55:23 -0700 (PDT) Message-Id: In-Reply-To: References: From: ffmpegagent Date: Sat, 14 May 2022 20:55:12 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v4 00/10] libavformat/asf: fix handling of byte array length values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Michael Niedermayer , softworkz Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The spec allows attachment sizes of up to UINT32_MAX while we can handle only sizes up to INT32_MAX (in downstream code) The debug.assert in get_tag didn't really address this, and truncating the value_len in calling methods cannot be used because the length value is required in order to continue parsing. This adds a check with log message in ff_asf_handle_byte_array to handle those (rare) cases. v2: Rebased & PING v3: Adjustments suggested by Michael v4: 1 of 11 merged, 10 to go.. softworkz (10): libavformat/asf: fix handling of byte array length values libavformat/asfdec: fix get_value return type and add checks for libavformat/asfdec: fix type of value_len libavformat/asfdec: fixing get_tag libavformat/asfdec: implement parsing of GUID values libavformat/asfdec: fix macro definition and use libavformat/asfdec: remove variable redefinition in inner scope libavformat/asfdec: ensure variables are initialized libavformat/asfdec: fix parameter type in asf_read_stream_propertie() libavformat/asfdec: fix variable types and add checks for unsupported values libavformat/asf.c | 8 +- libavformat/asf.h | 2 +- libavformat/asfdec_f.c | 338 +++++++++++++++++++++++++++-------------- 3 files changed, 229 insertions(+), 119 deletions(-) base-commit: e6f0cec88041449475f37b82b76699d2f7b5b124 Published-As: https://github.com/ffstaging/FFmpeg/releases/tag/pr-ffstaging-12%2Fsoftworkz%2Fmaster-upstream_asf_4-v4 Fetch-It-Via: git fetch https://github.com/ffstaging/FFmpeg pr-ffstaging-12/softworkz/master-upstream_asf_4-v4 Pull-Request: https://github.com/ffstaging/FFmpeg/pull/12 Range-diff vs v3: 1: b5c56bf5d0 = 1: 60966b7907 libavformat/asf: fix handling of byte array length values 2: e6aa0fb7f3 ! 2: 5acab7b52b libavformat/asfdec: fix get_value return type and add checks for @@ libavformat/asfdec_f.c: static int asf_probe(const AVProbeData *pd) { switch (type) { case ASF_BOOL: -@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int desc_count, i, ret; desc_count = avio_rl16(pb); -@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s) /* My sample has that stream set to 0 maybe that mean the container. * ASF stream count starts at 1. I am using 0 to the container value * since it's unused. */ @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, return 0; } -@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; @@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t int n, stream_num, name_len_utf16, name_len_utf8, value_len; int ret, i; n = avio_rl16(pb); -@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s) av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n", i, stream_num, name_len_utf16, value_type, value_len, name); 3: b84474d729 ! 3: 97e0d765c9 libavformat/asfdec: fix type of value_len @@ libavformat/asfdec_f.c: static uint64_t get_value(AVIOContext *pb, int type, int { ASFContext *asf = s->priv_data; char *value = NULL; -@@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContext *s, int64_t size) - static int asf_read_content_desc(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContext *s) + static int asf_read_content_desc(AVFormatContext *s) { AVIOContext *pb = s->pb; - int len1, len2, len3, len4, len5; @@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex len1 = avio_rl16(pb); len2 = avio_rl16(pb); -@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s) ASFContext *asf = s->priv_data; uint64_t dar_num[128] = {0}; uint64_t dar_den[128] = {0}; 4: a54feb51a1 = 4: 025123f72d libavformat/asfdec: fixing get_tag 5: e14beb2c15 = 5: 2d01e4dff5 libavformat/asfdec: implement parsing of GUID values 6: 06062da88b < -: ---------- libavformat/asfdec: remove unused parameters 7: 273823a5b4 = 6: 33b3d163df libavformat/asfdec: fix macro definition and use 8: aaa37aca21 = 7: 1509b83f47 libavformat/asfdec: remove variable redefinition in inner scope 9: 6aedb68b76 = 8: fd31b0be2e libavformat/asfdec: ensure variables are initialized 10: 28ebbe7289 = 9: f8728b1c51 libavformat/asfdec: fix parameter type in asf_read_stream_propertie() 11: bbeee5f2da = 10: 78ed5aeb38 libavformat/asfdec: fix variable types and add checks for unsupported values -- ffmpeg-codebot _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".