diff mbox series

[FFmpeg-devel,1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256

Message ID 20220512153019.66066-2-hello.vectronic@gmail.com
State New
Headers show
Series avcodec/exr: variable string attribute length | expand

Checks

Context Check Description
yinshiyou/make_fate_loongarch64 success Make fate finished
yinshiyou/make_loongarch64 warning New warnings during build
andriy/make_fate_x86 success Make fate finished
andriy/make_x86 warning New warnings during build

Commit Message

vectronic May 12, 2022, 3:30 p.m. UTC 
Signed-off-by: vectronic <hello.vectronic@gmail.com>
---
 libavcodec/exr.c | 32 +++++++++++++++++++++++---------
 1 file changed, 23 insertions(+), 9 deletions(-)

Comments

Paul B Mahol May 14, 2022, 10:41 a.m. UTC | #1 
On Thu, May 12, 2022 at 5:31 PM vectronic <hello.vectronic@gmail.com> wrote:

> Signed-off-by: vectronic <hello.vectronic@gmail.com>
> ---
>  libavcodec/exr.c | 32 +++++++++++++++++++++++---------
>  1 file changed, 23 insertions(+), 9 deletions(-)
>
> diff --git a/libavcodec/exr.c b/libavcodec/exr.c
> index 8cd867a32f..bc2afcee53 100644
> --- a/libavcodec/exr.c
> +++ b/libavcodec/exr.c
> @@ -1912,10 +1912,13 @@ static int decode_header(EXRContext *s, AVFrame
> *frame)
>              continue;
>          } else if ((var_size = check_header_variable(s, "writer",
>                                                       "string", 1)) >= 0) {
> -            uint8_t key[256] = { 0 };
> +            uint8_t *key = av_malloc(var_size);
>
> -            bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1,
> var_size));
> -            av_dict_set(&metadata, "writer", key, 0);
> +            if (!key)
> +                return AVERROR(ENOMEM);
> +
> +            bytestream2_get_buffer(gb, key, var_size);
> +            av_dict_set(&metadata, "writer", key,
> AV_DICT_DONT_STRDUP_VAL);
>

var_size can be very big number, potentially causing attacks vectors.


>
>              continue;
>          } else if ((var_size = check_header_variable(s, "framesPerSecond",
> @@ -1937,9 +1940,12 @@ static int decode_header(EXRContext *s, AVFrame
> *frame)
>              continue;
>          } else if ((var_size = check_header_variable(s, "type",
>                                                       "string", 16)) >= 0)
> {
> -            uint8_t key[256] = { 0 };
> +            uint8_t *key = av_malloc(var_size);
> +
> +            if (!key)
> +                return AVERROR(ENOMEM);
>
> -            bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1,
> var_size));
> +            bytestream2_get_buffer(gb, key, var_size);
>              if (strncmp("scanlineimage", key, var_size) &&
>                  strncmp("tiledimage", key, var_size))
>                  return AVERROR_PATCHWELCOME;
> @@ -1970,7 +1976,6 @@ static int decode_header(EXRContext *s, AVFrame
> *frame)
>          {
>              uint8_t name[256] = { 0 };
>              uint8_t type[256] = { 0 };
> -            uint8_t value[256] = { 0 };
>              int i = 0, size;
>
>              while (bytestream2_get_bytes_left(gb) > 0 &&
> @@ -1987,9 +1992,18 @@ static int decode_header(EXRContext *s, AVFrame
> *frame)
>              bytestream2_skip(gb, 1);
>              size = bytestream2_get_le32(gb);
>
> -            bytestream2_get_buffer(gb, value, FFMIN(sizeof(value) - 1,
> size));
> -            if (!strcmp(type, "string"))
> -                av_dict_set(&metadata, name, value, 0);
> +            if (strcmp(type, "string") != 0) {
> +                bytestream2_skip(gb, size);
> +
> +                continue;
> +            }
> +            uint8_t *value = av_malloc(size);
> +
> +            if (!value)
> +                return AVERROR(ENOMEM);
> +
> +            bytestream2_get_buffer(gb, value, size);
> +            av_dict_set(&metadata, name, value, AV_DICT_DONT_STRDUP_VAL);
>          }
>      }
>
> --
> 2.32.0 (Apple Git-132)
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
diff mbox series

Patch

diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 8cd867a32f..bc2afcee53 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1912,10 +1912,13 @@  static int decode_header(EXRContext *s, AVFrame *frame)
             continue;
         } else if ((var_size = check_header_variable(s, "writer",
                                                      "string", 1)) >= 0) {
-            uint8_t key[256] = { 0 };
+            uint8_t *key = av_malloc(var_size);
 
-            bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size));
-            av_dict_set(&metadata, "writer", key, 0);
+            if (!key)
+                return AVERROR(ENOMEM);
+
+            bytestream2_get_buffer(gb, key, var_size);
+            av_dict_set(&metadata, "writer", key, AV_DICT_DONT_STRDUP_VAL);
 
             continue;
         } else if ((var_size = check_header_variable(s, "framesPerSecond",
@@ -1937,9 +1940,12 @@  static int decode_header(EXRContext *s, AVFrame *frame)
             continue;
         } else if ((var_size = check_header_variable(s, "type",
                                                      "string", 16)) >= 0) {
-            uint8_t key[256] = { 0 };
+            uint8_t *key = av_malloc(var_size);
+
+            if (!key)
+                return AVERROR(ENOMEM);
 
-            bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size));
+            bytestream2_get_buffer(gb, key, var_size);
             if (strncmp("scanlineimage", key, var_size) &&
                 strncmp("tiledimage", key, var_size))
                 return AVERROR_PATCHWELCOME;
@@ -1970,7 +1976,6 @@  static int decode_header(EXRContext *s, AVFrame *frame)
         {
             uint8_t name[256] = { 0 };
             uint8_t type[256] = { 0 };
-            uint8_t value[256] = { 0 };
             int i = 0, size;
 
             while (bytestream2_get_bytes_left(gb) > 0 &&
@@ -1987,9 +1992,18 @@  static int decode_header(EXRContext *s, AVFrame *frame)
             bytestream2_skip(gb, 1);
             size = bytestream2_get_le32(gb);
 
-            bytestream2_get_buffer(gb, value, FFMIN(sizeof(value) - 1, size));
-            if (!strcmp(type, "string"))
-                av_dict_set(&metadata, name, value, 0);
+            if (strcmp(type, "string") != 0) {
+                bytestream2_skip(gb, size);
+
+                continue;
+            }
+            uint8_t *value = av_malloc(size);
+
+            if (!value)
+                return AVERROR(ENOMEM);
+
+            bytestream2_get_buffer(gb, value, size);
+            av_dict_set(&metadata, name, value, AV_DICT_DONT_STRDUP_VAL);
         }
     }