From patchwork Thu Jul 27 02:37:44 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Liu Steven X-Patchwork-Id: 43002 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:c11c:b0:130:ccc6:6c4b with SMTP id bh28csp131441pzb; Wed, 26 Jul 2023 19:38:08 -0700 (PDT) X-Google-Smtp-Source: APBJJlFun4oDgFrLxfu/MCUm3GXt6zKkxzZevHskokpxF8JdWmQtqw2tEn+xKIqatnQXCKS9W4RU X-Received: by 2002:ac2:5984:0:b0:4fd:f827:225a with SMTP id w4-20020ac25984000000b004fdf827225amr553128lfn.43.1690425488171; Wed, 26 Jul 2023 19:38:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1690425488; cv=none; d=google.com; s=arc-20160816; b=rEVxXpObWkXyAnO67T9orV1dHiwsTtEBPetn2JJ1nhxoA3UMkOJ5Uzl4aSWW0u8/Mi d7f/Bh/LaRxbZ8j9PeLr7i+HQRfRMFxeZWc87WEFX6sJZIrmREM8QTNaw644pp6I6/9t kwRUbWdnYXOfZueQ5I4fRh8C1+C+gwQp+ZZUKEBADwn5WtIgGc+MjveyxQ/QeXga7y0T lUsGRNjRLNe+4M5h1XO1907s/sz+KcS+DBNzp2FlHVMKuokOdVuUNk0G3WGsW43htl/R 733O58wzR9R1GVJLPx/7wK4wYx7Ks9VoBorS2tfs3zXL8mPg43uvTfdBap0bSyQ3tjeg 9/xw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:feedback-id:mime-version:message-id:date :to:from:delivered-to; bh=Qfrxj86W0s2RlPKkyeARhv87gpC8niHRUL/3n1v6xeo=; fh=UbKzVxiKqWMRVKHrgyn1mg7tw/nuokz5Lr8G3ZXebqo=; b=MGxbSsbDLqWfxzCjsG4JSJQgrdV7qo7h3jawjz3zyV54JcnsRqmaAyenZwQkbbhujj Ck3OcFLUOu1kumgy8p1hWX4lqIMNvzhHeLw1Rj1m9KYaElukQqq9W8/sCgLseXO/RVhQ BgEMyxOwiwFKSDVvh0ChbzuUJbbqn801DibeqzKARCGMh7KugFGfVk2jpm79MkSRUPWj pQZy+Z6PLzOQImOYtcFhgjckYn8K87yIMAmMrnqIdRfhjkGZwVfdXpv330e4BzyjQjOr TN2S5tU5L/6BSoP9bCnrJ9jEdV5t/lXN9uc2mI0aWHMLT5Y2e1XcNiwl6qYqVXgj1EWT VmBg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id t20-20020aa7d4d4000000b0051de4b6be0esi190129edr.646.2023.07.26.19.38.07; Wed, 26 Jul 2023 19:38:08 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 62BF268C9D2; Thu, 27 Jul 2023 05:38:03 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from bg4.exmail.qq.com (bg4.exmail.qq.com [43.154.54.12]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 219A168C812 for ; Thu, 27 Jul 2023 05:37:55 +0300 (EEST) X-QQ-mid: bizesmtp74t1690425468tj4359x9 Received: from localhost ( [103.102.203.196]) by bizesmtp.qq.com (ESMTP) with id ; Thu, 27 Jul 2023 10:37:46 +0800 (CST) X-QQ-SSF: 01100000000000Z0Z000000A0000000 X-QQ-FEAT: LE7C6P2vL8R280F0jMrzzx3tihbqFIK07v89o15m7vtPb14cyHdam1sfsOWpC ZQTZsX60Qar1fhZH8w02mLruUbAj6tpNLAKJDQqcxzAT4Z0B3VHvdeiinlSjJj0IB6dAMNs v8vpejiznfQ3xEQQBS2zXPIRRuCkUaEHoPxh7Yi/digtO2kjCHSFJN4nV5wVlm6ejBFFqmG jH5LIgUtxKzTyZbY4z5YSf+1ugLFIwb/L6T8D2QXpxefk09unomlHU+scHYVHSqdlipmKL3 oKVUoc/Ci8m+WCKX/4wsRnwFoozc9SFSxnOEN040xjBr14BGft0Wc9JiNzPcoQiqAabZs45 IA0Wc/SVQPsrn4qekXHNdaKecnZRg== X-QQ-GoodBg: 0 X-BIZMAIL-ID: 15733392504575821298 From: Steven Liu To: ffmpeg-devel@ffmpeg.org Date: Thu, 27 Jul 2023 10:37:44 +0800 Message-Id: <20230727023744.20984-1-lq@chinaffmpeg.org> X-Mailer: git-send-email 2.40.0 MIME-Version: 1.0 X-QQ-SENDSIZE: 520 Feedback-ID: bizesmtp:chinaffmpeg.org:qybglogicsvrsz:qybglogicsvrsz3a-0 Subject: [FFmpeg-devel] [PATCH] avformat/flvdec: use avio operation instead of pb->buf_ptr use X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Steven Liu Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: pzq3Y3iBLY2E fix segfaults: READ of size 1 at 0x6100000003b7 thread T0 #0 0x7f928d in flv_same_video_codec ffmpeg/libavformat/flvdec.c:317:29 #1 0x7f928d in flv_read_packet ffmpeg/libavformat/flvdec.c:1177 #2 0x6ff32f in ff_read_packet ffmpeg/libavformat/demux.c:575:15 #3 0x70a2fd in read_frame_internal ffmpeg/libavformat/demux.c:1263:15 #4 0x71d158 in avformat_find_stream_info ffmpeg/libavformat/demux.c:2634:15 #5 0x4c821b in LLVMFuzzerTestOneInput ffmpeg/tools/target_dem_fuzzer.c:206:11 Signed-off-by: Steven Liu --- libavformat/flvdec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 3fe21622f7..003e4d7691 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -313,8 +313,9 @@ static int flv_same_video_codec(AVFormatContext *s, AVCodecParameters *vpar, int return 1; if (flv->exheader) { - uint8_t *codec_id_str = (uint8_t *)s->pb->buf_ptr; - uint32_t codec_id = codec_id_str[3] | codec_id_str[2] << 8 | codec_id_str[1] << 16 | codec_id_str[0] << 24; + int64_t pos = avio_tell(s->pb); + uint32_t codec_id = avio_rb32(s->pb); + avio_seek(s->pb, pos, SEEK_SET); switch(codec_id) { case MKBETAG('h', 'v', 'c', '1'): return vpar->codec_id == AV_CODEC_ID_HEVC;