diff mbox

[FFmpeg-devel,2/7] 4xm: prevent overflow during block alignment calculation

Message ID a84036b6-ba3e-3189-f840-cd4cf33b48a5@googlemail.com
State Superseded
Headers show

Commit Message

Andreas Cadhalpun Dec. 16, 2016, 2:32 a.m. UTC 
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
---
 libavformat/4xm.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Rodger Combs Dec. 16, 2016, 2:33 a.m. UTC | #1 
> On Dec 15, 2016, at 20:32, Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> wrote:
> 
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
> ---
> libavformat/4xm.c | 1 +
> 1 file changed, 1 insertion(+)
> 
> diff --git a/libavformat/4xm.c b/libavformat/4xm.c
> index 2758b69..9332f78 100644
> --- a/libavformat/4xm.c
> +++ b/libavformat/4xm.c
> @@ -187,6 +187,7 @@ static int parse_strk(AVFormatContext *s,
>     st->codecpar->bit_rate              = (int64_t)st->codecpar->channels *
>                                           st->codecpar->sample_rate *
>                                           st->codecpar->bits_per_coded_sample;
> +    FF_BAIL_ON_OVERFLOW(s, st->codecpar->channels && st->codecpar->bits_per_coded_sample > INT_MAX / st->codecpar->channels)

Shouldn't this go before the actual (potentially-overflowing) calculation is done?

>     st->codecpar->block_align           = st->codecpar->channels *
>                                           st->codecpar->bits_per_coded_sample;
> 
> -- 
> 2.10.2
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
Andreas Cadhalpun Dec. 16, 2016, 2:36 a.m. UTC | #2 
On 16.12.2016 03:33, Rodger Combs wrote:
> 
>> On Dec 15, 2016, at 20:32, Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> wrote:
>>
>> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
>> ---
>> libavformat/4xm.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/libavformat/4xm.c b/libavformat/4xm.c
>> index 2758b69..9332f78 100644
>> --- a/libavformat/4xm.c
>> +++ b/libavformat/4xm.c
>> @@ -187,6 +187,7 @@ static int parse_strk(AVFormatContext *s,
>>     st->codecpar->bit_rate              = (int64_t)st->codecpar->channels *
>>                                           st->codecpar->sample_rate *
>>                                           st->codecpar->bits_per_coded_sample;
>> +    FF_BAIL_ON_OVERFLOW(s, st->codecpar->channels && st->codecpar->bits_per_coded_sample > INT_MAX / st->codecpar->channels)
> 
> Shouldn't this go before the actual (potentially-overflowing) calculation is done?

It is.

>>     st->codecpar->block_align           = st->codecpar->channels *
>>                                           st->codecpar->bits_per_coded_sample;

This here is the problem.

Best regards,
Andreas
Michael Niedermayer Dec. 16, 2016, 1:51 p.m. UTC | #3 
On Fri, Dec 16, 2016 at 03:32:42AM +0100, Andreas Cadhalpun wrote:
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
> ---
>  libavformat/4xm.c | 1 +
>  1 file changed, 1 insertion(+)

should be ok

[...]
diff mbox

Patch

diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index 2758b69..9332f78 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -187,6 +187,7 @@  static int parse_strk(AVFormatContext *s,
     st->codecpar->bit_rate              = (int64_t)st->codecpar->channels *
                                           st->codecpar->sample_rate *
                                           st->codecpar->bits_per_coded_sample;
+    FF_BAIL_ON_OVERFLOW(s, st->codecpar->channels && st->codecpar->bits_per_coded_sample > INT_MAX / st->codecpar->channels)
     st->codecpar->block_align           = st->codecpar->channels *
                                           st->codecpar->bits_per_coded_sample;