From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <ffmpeg-devel-bounces@ffmpeg.org>
Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100])
by master.gitmailbox.com (Postfix) with ESMTPS id 9D5974D7A3
for <ffmpegdev@gitmailbox.com>; Sun, 20 Apr 2025 01:56:47 +0000 (UTC)
Received: from [127.0.1.1] (localhost [127.0.0.1])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 1819D687DE2;
Sun, 20 Apr 2025 04:56:42 +0300 (EEST)
Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com
[209.85.210.177])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 83F83687B57
for <ffmpeg-devel@ffmpeg.org>; Sun, 20 Apr 2025 04:56:35 +0300 (EEST)
Received: by mail-pf1-f177.google.com with SMTP id
d2e1a72fcca58-736b350a22cso2414134b3a.1
for <ffmpeg-devel@ffmpeg.org>; Sat, 19 Apr 2025 18:56:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1745114194; x=1745718994; darn=ffmpeg.org;
h=cc:to:mime-version:content-transfer-encoding:fcc:subject:date
:message-id:from:from:to:cc:subject:date:message-id:reply-to;
bh=d0oHj8iaXFpBgs7A3tf2dHPMZ0Xx2ztgyVM+SyxRHSk=;
b=IfsiSe3zUK2/RF9T1cN23XPLzTwJzV1CZ1J6y2aQA0LDrZY/vYzNjDeYAxvGbwSeRC
VsBSOPwkyR9xwgqMZcNl5GBBCXHr/7ZMsknwHkTVk/zTz7cX1wk2C7PyhmClHIdTzLO4
RXHCitYNnS4kMBs0S+8U+tHhaNmKRFSDExQV8nIEeiBZ+Y6WssgmqGdi1QQCmyNVHxAQ
Ca08K8DUU1exmrbjMTsZ4MjCAhdDaGQFqybkaIrMZfaCzGoQ4aa1h4Di2u9zckwravdK
/8PBZcZIN8D3kTqOtg0YIbd4Mx28IlHPHngJMZE5AOAVPHUKO18J1NtcvISNZ/KxPoBz
+2NQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1745114194; x=1745718994;
h=cc:to:mime-version:content-transfer-encoding:fcc:subject:date
:message-id:from:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to;
bh=d0oHj8iaXFpBgs7A3tf2dHPMZ0Xx2ztgyVM+SyxRHSk=;
b=E/05CMfHB0fdhOL80vVMwUl72TNLzFA2thNdBuy9bnM/3ipmP2zwTQHvlinV83iN2x
OTnFo+eFBgv08A4s5IOD4ewaBKgn02AxrcVoS7XAZ9H9TuK8wcSb1NZ8BF1LJvITF4t+
RpP4spjfRXerJ8s1oGK2LSl3IEPgIT4ylNoghwugiloCjwyOakQRjAzUMc8QrNmguCRu
3V/72K7FDtjhu7sJmfwKAs2t60HZR1NcQ6KBl/4fYU4f6+Fir4e1H/KRBjtA7HVgSp4C
xGNtsiOKQq8m8FYQaj4lpsOLAkh2mapqlH84loxt0ZWESqhTq+F2MQZfCAp4RLEdYeag
nOSA==
X-Gm-Message-State: AOJu0Yx9m35FO0F9Gig7sfCs/BCOreQTTbylouHAo+jfz41b7Q1Oytra
gQ/RuKWW0DNK3vt2nP7eKMTr2idaXmNpQdCtKM7PQI5VyajY7LbVdJ/x/g==
X-Gm-Gg: ASbGncuGhaYljieAXEeY4wmP8DuIx3orAx3DQ5/x4R3HOlm8z37oX2AidJ5MiAZEstX
WtPxQfhDBYRzmsPWfB3fVhAJTDDjitX9gwu9Lv9EoCGT+EdIAh+YuFdAj4bu0RlCUlepDRFCJNe
aJjcos9h8gPuTo4ucLoPM+XVs1QsMQECiOgFXnNhE+W2G7k5pMBF1U5Tcp9Ok9X3HqMLKDdSYQQ
ZdFehFZm5MT7Kok9mzJLMQhxDFfU2tkzzAkf+KYJ4jeY6ti8Fxy1qhp7l8nT2fD45/4baC78mhR
Ui39b9q/fbDABYqN7hXPNrI12KKlfK04mrvdbC1ag83F5pfU50Fvt5g5/oY=
X-Google-Smtp-Source: AGHT+IEUS+2mjnjZVwrigq6cU57Piozb/P99QbVrvRnzR+Ub6womPRZIBUVZLWDCQhL9YhtRRkFT7g==
X-Received: by 2002:a05:6a00:4c17:b0:736:57cb:f2aa with SMTP id
d2e1a72fcca58-73dc14d34f3mr9406927b3a.13.1745114193529;
Sat, 19 Apr 2025 18:56:33 -0700 (PDT)
Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50])
by smtp.gmail.com with ESMTPSA id
d2e1a72fcca58-73dbfa5827fsm3960676b3a.116.2025.04.19.18.56.33
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Sat, 19 Apr 2025 18:56:33 -0700 (PDT)
From: softworkz <ffmpegagent@gmail.com>
X-Google-Original-From: softworkz <softworkz@hotmail.com>
Message-Id: <pull.70.ffstaging.FFmpeg.1745114187876.ffmpegagent@gmail.com>
Date: Sun, 20 Apr 2025 01:56:27 +0000
Fcc: Sent
MIME-Version: 1.0
To: ffmpeg-devel@ffmpeg.org
Subject: [FFmpeg-devel] [PATCH] libavformat/asfdec: Fix regression bug when
reading image attachments
X-BeenThere: ffmpeg-devel@ffmpeg.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org>
List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe>
List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel>
List-Post: <mailto:ffmpeg-devel@ffmpeg.org>
List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help>
List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe>
Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Cc: softworkz <softworkz@hotmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: ffmpeg-devel-bounces@ffmpeg.org
Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org>
Archived-At: <https://master.gitmailbox.com/ffmpegdev/pull.70.ffstaging.FFmpeg.1745114187876.ffmpegagent@gmail.com/>
List-Archive: <https://master.gitmailbox.com/ffmpegdev/>
List-Post: <mailto:ffmpegdev@gitmailbox.com>
From: softworkz <softworkz@hotmail.com>
Commit c8140fe7324f264faacf7395b27e12531d1f13f7 had introduced
a check for value_len > UINT16_MAX.
As a consequence, attached images of sizes larger than UINT16_MAX
could no longer be read.
This is a minimal fix of the regression, avoiding the controversies
of my earlier submission regarding int type handling in asfdec.
Signed-off-by: softworkz <softworkz@hotmail.com>
---
libavformat/asfdec: Fix regression bug when reading image attachments
Commit c8140fe7324f264faacf7395b27e12531d1f13f7 had introduced a check
for value_len > UINT16_MAX. As a consequence, attached images of sizes
larger than UINT16_MAX could no longer be read.
This is a minimal fix of the regression, avoiding the controversies of
my earlier submission regarding int type handling in asfdec.
Signed-off-by: softworkz softworkz@hotmail.com
Published-As: https://github.com/ffstaging/FFmpeg/releases/tag/pr-ffstaging-70%2Fsoftworkz%2Fsubmit_asf_attachments-v1
Fetch-It-Via: git fetch https://github.com/ffstaging/FFmpeg pr-ffstaging-70/softworkz/submit_asf_attachments-v1
Pull-Request: https://github.com/ffstaging/FFmpeg/pull/70
libavformat/asfdec_f.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index 2441cadb44..ef5e5696c8 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -608,7 +608,8 @@ static int asf_read_metadata(AVFormatContext *s)
{
AVIOContext *pb = s->pb;
ASFContext *asf = s->priv_data;
- int n, stream_num, name_len_utf16, name_len_utf8, value_len;
+ int n, stream_num, name_len_utf16, name_len_utf8;
+ unsigned int value_len;
int ret, i;
n = avio_rl16(pb);
@@ -622,7 +623,7 @@ static int asf_read_metadata(AVFormatContext *s)
value_type = avio_rl16(pb); /* value_type */
value_len = avio_rl32(pb);
- if (value_len < 0 || value_len > UINT16_MAX)
+ if (value_len < 0 || value_len >= (INT_MAX - LEN) / 2)
return AVERROR_INVALIDDATA;
name_len_utf8 = 2*name_len_utf16 + 1;
base-commit: 7cd1edeaa410d977a9f1ff8436f480cb45b80178
--
ffmpeg-codebot
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".