diff mbox

[FFmpeg-devel] ffprobe: fix use of uninitialized variable

Message ID CA+mt-xrR2Y4WX2adASezzYWcchBDDo6raM66ZW5E7aQat7OjnQ@mail.gmail.com
State New
Headers show

Commit Message

Zhao Zhili Aug. 6, 2017, 7:39 a.m. UTC
---
 ffprobe.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

                 av_log(NULL, AV_LOG_ERROR, "Invalid interval end/duration
specification '%s'\n", p);
@@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
*interval_spec,
         }
     } else {
         interval->has_end = 0;
+        interval->duration_frames = 0;
     }

 end:
@@ -3357,7 +3359,7 @@ static int parse_read_intervals(const char
*intervals_spec)
             n++;
     n++;

-    read_intervals = av_malloc_array(n, sizeof(*read_intervals));
+    read_intervals = av_mallocz_array(n, sizeof(*read_intervals));
     if (!read_intervals) {
         ret = AVERROR(ENOMEM);
         goto end;

Comments

Michael Niedermayer Aug. 8, 2017, 5:23 p.m. UTC | #1
On Sun, Aug 06, 2017 at 03:39:07PM +0800, Zhao Zhili wrote:
> ---
>  ffprobe.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/ffprobe.c b/ffprobe.c
> index f22c4f57ad..ac9ff051fa 100644
> --- a/ffprobe.c
> +++ b/ffprobe.c
> @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
> *interval_spec,
>              }
>              interval->end = lli;
>          } else {
> +            interval->duration_frames = 0;
>              ret = av_parse_time(&us, p, 1);
>              if (ret < 0) {
>                  av_log(NULL, AV_LOG_ERROR, "Invalid interval end/duration
> specification '%s'\n", p);
> @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
> *interval_spec,
>          }
>      } else {
>          interval->has_end = 0;
> +        interval->duration_frames = 0;
>      }
> 
>  end:
> @@ -3357,7 +3359,7 @@ static int parse_read_intervals(const char
> *intervals_spec)
>              n++;
>      n++;
> 
> -    read_intervals = av_malloc_array(n, sizeof(*read_intervals));
> +    read_intervals = av_mallocz_array(n, sizeof(*read_intervals));
>      if (!read_intervals) {
>          ret = AVERROR(ENOMEM);
>          goto end;
> -- 
> 2.13.2

>  ffprobe.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 59efe1bf808d9621c14252fd0e71dc4b9a635c7a  0001-ffprobe-fix-use-of-uninitialized-variable.patch
> From 1d3fe1eb4cd27efc337a1fae302f5539e3c7459b Mon Sep 17 00:00:00 2001
> From: Zhao Zhili <wantlamy@gmail.com>
> Date: Sun, 6 Aug 2017 15:33:42 +0800
> Subject: [PATCH] ffprobe: fix use of uninitialized variable
> 
> ---
>  ffprobe.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/ffprobe.c b/ffprobe.c
> index f22c4f57ad..ac9ff051fa 100644
> --- a/ffprobe.c
> +++ b/ffprobe.c
> @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char *interval_spec,
>              }
>              interval->end = lli;
>          } else {
> +            interval->duration_frames = 0;
>              ret = av_parse_time(&us, p, 1);
>              if (ret < 0) {
>                  av_log(NULL, AV_LOG_ERROR, "Invalid interval end/duration specification '%s'\n", p);

> @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char *interval_spec,
>          }
>      } else {
>          interval->has_end = 0;
> +        interval->duration_frames = 0;
>      }

isnt has_end and end_is_offset 0 here and all uses of duration_frames
under code checking either ?


[...]
Zhao Zhili Aug. 9, 2017, 5:05 a.m. UTC | #2
On Wed, Aug 9, 2017 at 1:23 AM, Michael Niedermayer <michael@niedermayer.cc>
wrote:

> On Sun, Aug 06, 2017 at 03:39:07PM +0800, Zhao Zhili wrote:
> > ---
> >  ffprobe.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/ffprobe.c b/ffprobe.c
> > index f22c4f57ad..ac9ff051fa 100644
> > --- a/ffprobe.c
> > +++ b/ffprobe.c
> > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
> > *interval_spec,
> >              }
> >              interval->end = lli;
> >          } else {
> > +            interval->duration_frames = 0;
> >              ret = av_parse_time(&us, p, 1);
> >              if (ret < 0) {
> >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
> end/duration
> > specification '%s'\n", p);
> > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
> > *interval_spec,
> >          }
> >      } else {
> >          interval->has_end = 0;
> > +        interval->duration_frames = 0;
> >      }
> >
> >  end:
> > @@ -3357,7 +3359,7 @@ static int parse_read_intervals(const char
> > *intervals_spec)
> >              n++;
> >      n++;
> >
> > -    read_intervals = av_malloc_array(n, sizeof(*read_intervals));
> > +    read_intervals = av_mallocz_array(n, sizeof(*read_intervals));
> >      if (!read_intervals) {
> >          ret = AVERROR(ENOMEM);
> >          goto end;
> > --
> > 2.13.2
>
> >  ffprobe.c |    4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 59efe1bf808d9621c14252fd0e71dc4b9a635c7a  0001-ffprobe-fix-use-of-
> uninitialized-variable.patch
> > From 1d3fe1eb4cd27efc337a1fae302f5539e3c7459b Mon Sep 17 00:00:00 2001
> > From: Zhao Zhili <wantlamy@gmail.com>
> > Date: Sun, 6 Aug 2017 15:33:42 +0800
> > Subject: [PATCH] ffprobe: fix use of uninitialized variable
> >
> > ---
> >  ffprobe.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/ffprobe.c b/ffprobe.c
> > index f22c4f57ad..ac9ff051fa 100644
> > --- a/ffprobe.c
> > +++ b/ffprobe.c
> > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
> *interval_spec,
> >              }
> >              interval->end = lli;
> >          } else {
> > +            interval->duration_frames = 0;
> >              ret = av_parse_time(&us, p, 1);
> >              if (ret < 0) {
> >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
> end/duration specification '%s'\n", p);
>
> > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
> *interval_spec,
> >          }
> >      } else {
> >          interval->has_end = 0;
> > +        interval->duration_frames = 0;
> >      }
>
> isnt has_end and end_is_offset 0 here and all uses of duration_frames
> under code checking either ?
>
>
If end_is_offset is 1 and *p is not '#', then duration_frames is not
initialized. So check end_is_offset doesn't prevent access uninitialized
value. And the current code didn't always check end_is_offset before access
duration_frames.

A simple test case:
ffprobe -show_frames -select_streams v -read_intervals '%+60' foo



>
> [...]
>
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> In a rich man's house there is no place to spit but his face.
> -- Diogenes of Sinope
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
>
Zhao Zhili Aug. 16, 2017, 12:25 p.m. UTC | #3
Ping.

On Wed, Aug 9, 2017 at 1:05 PM, Zhao Zhili <wantlamy@gmail.com> wrote:

>
>
> On Wed, Aug 9, 2017 at 1:23 AM, Michael Niedermayer <
> michael@niedermayer.cc> wrote:
>
>> On Sun, Aug 06, 2017 at 03:39:07PM +0800, Zhao Zhili wrote:
>> > ---
>> >  ffprobe.c | 4 +++-
>> >  1 file changed, 3 insertions(+), 1 deletion(-)
>> >
>> > diff --git a/ffprobe.c b/ffprobe.c
>> > index f22c4f57ad..ac9ff051fa 100644
>> > --- a/ffprobe.c
>> > +++ b/ffprobe.c
>> > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
>> > *interval_spec,
>> >              }
>> >              interval->end = lli;
>> >          } else {
>> > +            interval->duration_frames = 0;
>> >              ret = av_parse_time(&us, p, 1);
>> >              if (ret < 0) {
>> >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
>> end/duration
>> > specification '%s'\n", p);
>> > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
>> > *interval_spec,
>> >          }
>> >      } else {
>> >          interval->has_end = 0;
>> > +        interval->duration_frames = 0;
>> >      }
>> >
>> >  end:
>> > @@ -3357,7 +3359,7 @@ static int parse_read_intervals(const char
>> > *intervals_spec)
>> >              n++;
>> >      n++;
>> >
>> > -    read_intervals = av_malloc_array(n, sizeof(*read_intervals));
>> > +    read_intervals = av_mallocz_array(n, sizeof(*read_intervals));
>> >      if (!read_intervals) {
>> >          ret = AVERROR(ENOMEM);
>> >          goto end;
>> > --
>> > 2.13.2
>>
>> >  ffprobe.c |    4 +++-
>> >  1 file changed, 3 insertions(+), 1 deletion(-)
>> > 59efe1bf808d9621c14252fd0e71dc4b9a635c7a
>> 0001-ffprobe-fix-use-of-uninitialized-variable.patch
>> > From 1d3fe1eb4cd27efc337a1fae302f5539e3c7459b Mon Sep 17 00:00:00 2001
>> > From: Zhao Zhili <wantlamy@gmail.com>
>> > Date: Sun, 6 Aug 2017 15:33:42 +0800
>> > Subject: [PATCH] ffprobe: fix use of uninitialized variable
>> >
>> > ---
>> >  ffprobe.c | 4 +++-
>> >  1 file changed, 3 insertions(+), 1 deletion(-)
>> >
>> > diff --git a/ffprobe.c b/ffprobe.c
>> > index f22c4f57ad..ac9ff051fa 100644
>> > --- a/ffprobe.c
>> > +++ b/ffprobe.c
>> > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
>> *interval_spec,
>> >              }
>> >              interval->end = lli;
>> >          } else {
>> > +            interval->duration_frames = 0;
>> >              ret = av_parse_time(&us, p, 1);
>> >              if (ret < 0) {
>> >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
>> end/duration specification '%s'\n", p);
>>
>> > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
>> *interval_spec,
>> >          }
>> >      } else {
>> >          interval->has_end = 0;
>> > +        interval->duration_frames = 0;
>> >      }
>>
>> isnt has_end and end_is_offset 0 here and all uses of duration_frames
>> under code checking either ?
>>
>>
> If end_is_offset is 1 and *p is not '#', then duration_frames is not
> initialized. So check end_is_offset doesn't prevent access uninitialized
> value. And the current code didn't always check end_is_offset before access
> duration_frames.
>
> A simple test case:
> ffprobe -show_frames -select_streams v -read_intervals '%+60' foo
>
>
>
>>
>> [...]
>>
>> --
>> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>>
>> In a rich man's house there is no place to spit but his face.
>> -- Diogenes of Sinope
>>
>> _______________________________________________
>> ffmpeg-devel mailing list
>> ffmpeg-devel@ffmpeg.org
>> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>>
>>
>
Michael Niedermayer Aug. 16, 2017, 7:24 p.m. UTC | #4
On Wed, Aug 09, 2017 at 01:05:11PM +0800, Zhao Zhili wrote:
> On Wed, Aug 9, 2017 at 1:23 AM, Michael Niedermayer <michael@niedermayer.cc>
> wrote:
> 
> > On Sun, Aug 06, 2017 at 03:39:07PM +0800, Zhao Zhili wrote:
> > > ---
> > >  ffprobe.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/ffprobe.c b/ffprobe.c
> > > index f22c4f57ad..ac9ff051fa 100644
> > > --- a/ffprobe.c
> > > +++ b/ffprobe.c
> > > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
> > > *interval_spec,
> > >              }
> > >              interval->end = lli;
> > >          } else {
> > > +            interval->duration_frames = 0;
> > >              ret = av_parse_time(&us, p, 1);
> > >              if (ret < 0) {
> > >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
> > end/duration
> > > specification '%s'\n", p);
> > > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
> > > *interval_spec,
> > >          }
> > >      } else {
> > >          interval->has_end = 0;
> > > +        interval->duration_frames = 0;
> > >      }
> > >
> > >  end:
> > > @@ -3357,7 +3359,7 @@ static int parse_read_intervals(const char
> > > *intervals_spec)
> > >              n++;
> > >      n++;
> > >
> > > -    read_intervals = av_malloc_array(n, sizeof(*read_intervals));
> > > +    read_intervals = av_mallocz_array(n, sizeof(*read_intervals));
> > >      if (!read_intervals) {
> > >          ret = AVERROR(ENOMEM);
> > >          goto end;
> > > --
> > > 2.13.2
> >
> > >  ffprobe.c |    4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > 59efe1bf808d9621c14252fd0e71dc4b9a635c7a  0001-ffprobe-fix-use-of-
> > uninitialized-variable.patch
> > > From 1d3fe1eb4cd27efc337a1fae302f5539e3c7459b Mon Sep 17 00:00:00 2001
> > > From: Zhao Zhili <wantlamy@gmail.com>
> > > Date: Sun, 6 Aug 2017 15:33:42 +0800
> > > Subject: [PATCH] ffprobe: fix use of uninitialized variable
> > >
> > > ---
> > >  ffprobe.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/ffprobe.c b/ffprobe.c
> > > index f22c4f57ad..ac9ff051fa 100644
> > > --- a/ffprobe.c
> > > +++ b/ffprobe.c
> > > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
> > *interval_spec,
> > >              }
> > >              interval->end = lli;
> > >          } else {
> > > +            interval->duration_frames = 0;
> > >              ret = av_parse_time(&us, p, 1);
> > >              if (ret < 0) {
> > >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
> > end/duration specification '%s'\n", p);
> >

> > > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
> > *interval_spec,
> > >          }
> > >      } else {
> > >          interval->has_end = 0;
> > > +        interval->duration_frames = 0;
> > >      }
> >
> > isnt has_end and end_is_offset 0 here and all uses of duration_frames
> > under code checking either ?
> >
> >
> If end_is_offset is 1 and *p is not '#', then duration_frames is not
> initialized.

The code quoted above is under the else, while the only code setting
end_is_offset is under the if() side.
how can you have end_is_offset == 1 without duration_frames being
set ?

further your patch allocates the intervals with av_mallocz_array()
how can they be uninitialized if they are cleared during allocation?

To me it looks like your code initializes the variable 3 times
2 are unneeded.
But this is not code i know well so it may be that iam missing
something



> So check end_is_offset doesn't prevent access uninitialized
> value. And the current code didn't always check end_is_offset before access
> duration_frames.
> 
> A simple test case:
> ffprobe -show_frames -select_streams v -read_intervals '%+60' foo

yes i can drop 2 hunks of the patch and it still fixes the issue

[...]
Zhao Zhili Aug. 17, 2017, 2:49 a.m. UTC | #5
On Thu, Aug 17, 2017 at 3:24 AM, Michael Niedermayer <michael@niedermayer.cc
> wrote:

> On Wed, Aug 09, 2017 at 01:05:11PM +0800, Zhao Zhili wrote:
> > On Wed, Aug 9, 2017 at 1:23 AM, Michael Niedermayer
> <michael@niedermayer.cc>
> > wrote:
> >
> > > On Sun, Aug 06, 2017 at 03:39:07PM +0800, Zhao Zhili wrote:
> > > > ---
> > > >  ffprobe.c | 4 +++-
> > > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/ffprobe.c b/ffprobe.c
> > > > index f22c4f57ad..ac9ff051fa 100644
> > > > --- a/ffprobe.c
> > > > +++ b/ffprobe.c
> > > > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
> > > > *interval_spec,
> > > >              }
> > > >              interval->end = lli;
> > > >          } else {
> > > > +            interval->duration_frames = 0;
> > > >              ret = av_parse_time(&us, p, 1);
> > > >              if (ret < 0) {
> > > >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
> > > end/duration
> > > > specification '%s'\n", p);
> > > > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
> > > > *interval_spec,
> > > >          }
> > > >      } else {
> > > >          interval->has_end = 0;
> > > > +        interval->duration_frames = 0;
> > > >      }
> > > >
> > > >  end:
> > > > @@ -3357,7 +3359,7 @@ static int parse_read_intervals(const char
> > > > *intervals_spec)
> > > >              n++;
> > > >      n++;
> > > >
> > > > -    read_intervals = av_malloc_array(n, sizeof(*read_intervals));
> > > > +    read_intervals = av_mallocz_array(n, sizeof(*read_intervals));
> > > >      if (!read_intervals) {
> > > >          ret = AVERROR(ENOMEM);
> > > >          goto end;
> > > > --
> > > > 2.13.2
> > >
> > > >  ffprobe.c |    4 +++-
> > > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > > 59efe1bf808d9621c14252fd0e71dc4b9a635c7a  0001-ffprobe-fix-use-of-
> > > uninitialized-variable.patch
> > > > From 1d3fe1eb4cd27efc337a1fae302f5539e3c7459b Mon Sep 17 00:00:00
> 2001
> > > > From: Zhao Zhili <wantlamy@gmail.com>
> > > > Date: Sun, 6 Aug 2017 15:33:42 +0800
> > > > Subject: [PATCH] ffprobe: fix use of uninitialized variable
> > > >
> > > > ---
> > > >  ffprobe.c | 4 +++-
> > > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/ffprobe.c b/ffprobe.c
> > > > index f22c4f57ad..ac9ff051fa 100644
> > > > --- a/ffprobe.c
> > > > +++ b/ffprobe.c
> > > > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
> > > *interval_spec,
> > > >              }
> > > >              interval->end = lli;
> > > >          } else {
> > > > +            interval->duration_frames = 0;
> > > >              ret = av_parse_time(&us, p, 1);
> > > >              if (ret < 0) {
> > > >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
> > > end/duration specification '%s'\n", p);
> > >
>
> > > > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
> > > *interval_spec,
> > > >          }
> > > >      } else {
> > > >          interval->has_end = 0;
> > > > +        interval->duration_frames = 0;
> > > >      }
> > >
> > > isnt has_end and end_is_offset 0 here and all uses of duration_frames
> > > under code checking either ?
> > >
> > >
> > If end_is_offset is 1 and *p is not '#', then duration_frames is not
> > initialized.
>
> The code quoted above is under the else, while the only code setting
> end_is_offset is under the if() side.
> how can you have end_is_offset == 1 without duration_frames being
> set ?
>
> further your patch allocates the intervals with av_mallocz_array()
> how can they be uninitialized if they are cleared during allocation?
>
> To me it looks like your code initializes the variable 3 times
> 2 are unneeded.
> But this is not code i know well so it may be that iam missing
> something
>
>
Sorry, I misunderstood your comment before. Yes there is only one place
which duration_frames
must be initialized. A new patch is attached.



>
>
> > So check end_is_offset doesn't prevent access uninitialized
> > value. And the current code didn't always check end_is_offset before
> access
> > duration_frames.
> >
> > A simple test case:
> > ffprobe -show_frames -select_streams v -read_intervals '%+60' foo
>
> yes i can drop 2 hunks of the patch and it still fixes the issue
>
> [...]
>
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> Those who would give up essential Liberty, to purchase a little
> temporary Safety, deserve neither Liberty nor Safety -- Benjamin Franklin
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
>
Michael Niedermayer Aug. 18, 2017, 12:18 a.m. UTC | #6
On Thu, Aug 17, 2017 at 10:49:37AM +0800, Zhao Zhili wrote:
> On Thu, Aug 17, 2017 at 3:24 AM, Michael Niedermayer <michael@niedermayer.cc
> > wrote:
> 
> > On Wed, Aug 09, 2017 at 01:05:11PM +0800, Zhao Zhili wrote:
> > > On Wed, Aug 9, 2017 at 1:23 AM, Michael Niedermayer
> > <michael@niedermayer.cc>
> > > wrote:
> > >
> > > > On Sun, Aug 06, 2017 at 03:39:07PM +0800, Zhao Zhili wrote:
> > > > > ---
> > > > >  ffprobe.c | 4 +++-
> > > > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > > >
> > > > > diff --git a/ffprobe.c b/ffprobe.c
> > > > > index f22c4f57ad..ac9ff051fa 100644
> > > > > --- a/ffprobe.c
> > > > > +++ b/ffprobe.c
> > > > > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
> > > > > *interval_spec,
> > > > >              }
> > > > >              interval->end = lli;
> > > > >          } else {
> > > > > +            interval->duration_frames = 0;
> > > > >              ret = av_parse_time(&us, p, 1);
> > > > >              if (ret < 0) {
> > > > >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
> > > > end/duration
> > > > > specification '%s'\n", p);
> > > > > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
> > > > > *interval_spec,
> > > > >          }
> > > > >      } else {
> > > > >          interval->has_end = 0;
> > > > > +        interval->duration_frames = 0;
> > > > >      }
> > > > >
> > > > >  end:
> > > > > @@ -3357,7 +3359,7 @@ static int parse_read_intervals(const char
> > > > > *intervals_spec)
> > > > >              n++;
> > > > >      n++;
> > > > >
> > > > > -    read_intervals = av_malloc_array(n, sizeof(*read_intervals));
> > > > > +    read_intervals = av_mallocz_array(n, sizeof(*read_intervals));
> > > > >      if (!read_intervals) {
> > > > >          ret = AVERROR(ENOMEM);
> > > > >          goto end;
> > > > > --
> > > > > 2.13.2
> > > >
> > > > >  ffprobe.c |    4 +++-
> > > > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > > > 59efe1bf808d9621c14252fd0e71dc4b9a635c7a  0001-ffprobe-fix-use-of-
> > > > uninitialized-variable.patch
> > > > > From 1d3fe1eb4cd27efc337a1fae302f5539e3c7459b Mon Sep 17 00:00:00
> > 2001
> > > > > From: Zhao Zhili <wantlamy@gmail.com>
> > > > > Date: Sun, 6 Aug 2017 15:33:42 +0800
> > > > > Subject: [PATCH] ffprobe: fix use of uninitialized variable
> > > > >
> > > > > ---
> > > > >  ffprobe.c | 4 +++-
> > > > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > > >
> > > > > diff --git a/ffprobe.c b/ffprobe.c
> > > > > index f22c4f57ad..ac9ff051fa 100644
> > > > > --- a/ffprobe.c
> > > > > +++ b/ffprobe.c
> > > > > @@ -3328,6 +3328,7 @@ static int parse_read_interval(const char
> > > > *interval_spec,
> > > > >              }
> > > > >              interval->end = lli;
> > > > >          } else {
> > > > > +            interval->duration_frames = 0;
> > > > >              ret = av_parse_time(&us, p, 1);
> > > > >              if (ret < 0) {
> > > > >                  av_log(NULL, AV_LOG_ERROR, "Invalid interval
> > > > end/duration specification '%s'\n", p);
> > > >
> >
> > > > > @@ -3337,6 +3338,7 @@ static int parse_read_interval(const char
> > > > *interval_spec,
> > > > >          }
> > > > >      } else {
> > > > >          interval->has_end = 0;
> > > > > +        interval->duration_frames = 0;
> > > > >      }
> > > >
> > > > isnt has_end and end_is_offset 0 here and all uses of duration_frames
> > > > under code checking either ?
> > > >
> > > >
> > > If end_is_offset is 1 and *p is not '#', then duration_frames is not
> > > initialized.
> >
> > The code quoted above is under the else, while the only code setting
> > end_is_offset is under the if() side.
> > how can you have end_is_offset == 1 without duration_frames being
> > set ?
> >
> > further your patch allocates the intervals with av_mallocz_array()
> > how can they be uninitialized if they are cleared during allocation?
> >
> > To me it looks like your code initializes the variable 3 times
> > 2 are unneeded.
> > But this is not code i know well so it may be that iam missing
> > something
> >
> >
> Sorry, I misunderstood your comment before. Yes there is only one place
> which duration_frames
> must be initialized. A new patch is attached.
> 
> 
> 
> >
> >
> > > So check end_is_offset doesn't prevent access uninitialized
> > > value. And the current code didn't always check end_is_offset before
> > access
> > > duration_frames.
> > >
> > > A simple test case:
> > > ffprobe -show_frames -select_streams v -read_intervals '%+60' foo
> >
> > yes i can drop 2 hunks of the patch and it still fixes the issue
> >
> > [...]
> >
> > --
> > Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
> >
> > Those who would give up essential Liberty, to purchase a little
> > temporary Safety, deserve neither Liberty nor Safety -- Benjamin Franklin
> >
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel@ffmpeg.org
> > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> >
> >

>  ffprobe.c |    1 +
>  1 file changed, 1 insertion(+)
> 24395943b86a20ae2da6cb2f6f11ca6bdede48d9  0001-ffprobe-fix-use-of-uninitialized-variable.patch
> From c1e0bc31dcbda714eb589d40f756580266ba6b14 Mon Sep 17 00:00:00 2001
> From: Zhao Zhili <wantlamy@gmail.com>
> Date: Thu, 17 Aug 2017 10:24:01 +0800
> Subject: [PATCH] ffprobe: fix use of uninitialized variable
> 
> ---
>  ffprobe.c | 1 +
>  1 file changed, 1 insertion(+)

applied

thanks

[...]
diff mbox

Patch

diff --git a/ffprobe.c b/ffprobe.c
index f22c4f57ad..ac9ff051fa 100644
--- a/ffprobe.c
+++ b/ffprobe.c
@@ -3328,6 +3328,7 @@  static int parse_read_interval(const char
*interval_spec,
             }
             interval->end = lli;
         } else {
+            interval->duration_frames = 0;
             ret = av_parse_time(&us, p, 1);
             if (ret < 0) {