| Message ID | CAADho6MLfRYZsshCVZsgZTL8WOmWkoY_CFOig16JgDwAWxmHqg@mail.gmail.com |
|---|---|
| State | Accepted |
| Headers | show |
On Wed, Dec 14, 2016 at 03:38:18PM -0800, Matthew Wolenetz wrote: > In ff_index_search_timestamp(), if b == num_entries, > m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is > true, then the search for the next non-discarded packet could access > entries[nb_entries], exceeding its bounds. This change adds a protection > against that scenario. Reference: https://crbug.com/666770 > utils.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > 309ffb570701252b564cf92d8c76a57d9413d23f 666770-lavf-utils.c-Protect-against-accessing-entries-nb_en.patch > From e91355afac548fbc7cc0cb4ecbc06dce6495df80 Mon Sep 17 00:00:00 2001 > From: Matt Wolenetz <wolenetz@chromium.org> > Date: Mon, 21 Nov 2016 15:54:02 -0800 > Subject: [PATCH] lavf/utils.c Protect against accessing entries[nb_entries] > > In ff_index_search_timestamp(), if b == num_entries, > m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is > true, then the search for the next non-discarded packet could access > entries[nb_entries], exceeding its bounds. This change adds a protection > against that scenario. Reference: https://crbug.com/666770 > --- > libavformat/utils.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavformat/utils.c b/libavformat/utils.c > index fb17423..b2d25eb 100644 > --- a/libavformat/utils.c > +++ b/libavformat/utils.c > @@ -1968,7 +1968,7 @@ int ff_index_search_timestamp(const AVIndexEntry *entries, int nb_entries, > m = (a + b) >> 1; > > // Search for the next non-discarded packet. > - while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b) { > + while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b && m < nb_entries - 1) { Maybe sasi inguva can comment but i wonder if the code shouldnt check the left side of m if nothing is found on the right [...]
Sorry for the late review. this patch seems ok to me. On Wed, Dec 14, 2016 at 7:34 PM, Michael Niedermayer <michael@niedermayer.cc > wrote: > On Wed, Dec 14, 2016 at 03:38:18PM -0800, Matthew Wolenetz wrote: > > In ff_index_search_timestamp(), if b == num_entries, > > m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is > > true, then the search for the next non-discarded packet could access > > entries[nb_entries], exceeding its bounds. This change adds a protection > > against that scenario. Reference: https://crbug.com/666770 > > > utils.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > 309ffb570701252b564cf92d8c76a57d9413d23f 666770-lavf-utils.c-Protect- > against-accessing-entries-nb_en.patch > > From e91355afac548fbc7cc0cb4ecbc06dce6495df80 Mon Sep 17 00:00:00 2001 > > From: Matt Wolenetz <wolenetz@chromium.org> > > Date: Mon, 21 Nov 2016 15:54:02 -0800 > > Subject: [PATCH] lavf/utils.c Protect against accessing > entries[nb_entries] > > > > In ff_index_search_timestamp(), if b == num_entries, > > m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is > > true, then the search for the next non-discarded packet could access > > entries[nb_entries], exceeding its bounds. This change adds a protection > > against that scenario. Reference: https://crbug.com/666770 > > --- > > libavformat/utils.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavformat/utils.c b/libavformat/utils.c > > index fb17423..b2d25eb 100644 > > --- a/libavformat/utils.c > > +++ b/libavformat/utils.c > > @@ -1968,7 +1968,7 @@ int ff_index_search_timestamp(const AVIndexEntry > *entries, int nb_entries, > > m = (a + b) >> 1; > > > > // Search for the next non-discarded packet. > > - while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b) { > > + while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b && m > < nb_entries - 1) { > > Maybe sasi inguva can comment but i wonder if the code shouldnt > check the left side of m if nothing is found on the right > Yes, the code should make m go to the left side if nothing is found on the right. > > [...] > > -- > Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB > > What does censorship reveal? It reveals fear. -- Julian Assange >
On Thu, Dec 29, 2016 at 01:42:26PM -0800, Sasi Inguva wrote:
> Sorry for the late review. this patch seems ok to me.
applied
thx
[...]
From e91355afac548fbc7cc0cb4ecbc06dce6495df80 Mon Sep 17 00:00:00 2001 From: Matt Wolenetz <wolenetz@chromium.org> Date: Mon, 21 Nov 2016 15:54:02 -0800 Subject: [PATCH] lavf/utils.c Protect against accessing entries[nb_entries] In ff_index_search_timestamp(), if b == num_entries, m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is true, then the search for the next non-discarded packet could access entries[nb_entries], exceeding its bounds. This change adds a protection against that scenario. Reference: https://crbug.com/666770 --- libavformat/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/utils.c b/libavformat/utils.c index fb17423..b2d25eb 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -1968,7 +1968,7 @@ int ff_index_search_timestamp(const AVIndexEntry *entries, int nb_entries, m = (a + b) >> 1; // Search for the next non-discarded packet. - while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b) { + while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b && m < nb_entries - 1) { m++; if (m == b && entries[m].timestamp >= wanted_timestamp) { m = b - 1; -- 2.8.0.rc3.226.g39d4020