From patchwork Fri Oct 12 04:02:04 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Karmani X-Patchwork-Id: 10647 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 7EE9D4452EF for ; Fri, 12 Oct 2018 07:02:21 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id B563868A4D6; Fri, 12 Oct 2018 07:02:02 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pf1-f195.google.com (mail-pf1-f195.google.com [209.85.210.195]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id B380068A47D for ; Fri, 12 Oct 2018 07:01:55 +0300 (EEST) Received: by mail-pf1-f195.google.com with SMTP id c25-v6so5482313pfe.6 for ; Thu, 11 Oct 2018 21:02:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tmm1-net.20150623.gappssmtp.com; s=20150623; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=iv4RssVCTWOQcFA2TbgfiDDoArXarWPwbi8NzHTGq+U=; b=dmnj/k+unv06DiRo9Jf3TCcjHELf2bcVeNscBoM8RbibXT2UWpu6gx7nJwalbOIos1 K7eXP2uECLBp7xO2sqsEAjQu67GGmGaCQ1ccBFTqQ1ztEcu7BMUBmpIioSltQEXjBxMX wXnoIO+nG8O6cESDpk+R9NoT78hS50spxYM/HPyBOgzLD93CRWNi935OatVq+TUPJM8j 7mEyEDAJcgx86P6sooYjuNOR0HPMla9blAZ/HfIbxGXz+tcRNWz9LRqFddr8J1ka+lPF kjPYmc8N4vn6zrgE+t8xxT8fsHuJuyMHSLtShQeQgLMQJ2vlQl3MDeRePZ83u6VAPClD eUug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=iv4RssVCTWOQcFA2TbgfiDDoArXarWPwbi8NzHTGq+U=; b=QgAZdepM3XCNc3g5bXKvX0ZOO1P3UlkUPzRnfHJxNpe0axgNpYuFi0ddJWfZgwF4RJ ZpUN9NoVNp59pzECAMIkQwFC19C+8bMIezGVkSHlthQIdGdaZQTzx2OIPCsv2YY2niZt Jz8JVtHZdIixiz4juNbrjDs2eB8IGbuFiyA5bRR64OFq3eMKxAWfMpE8Rp9rtpAjkVyW KEji/Brpzzrj+yCxHbG85jCd4qacgKoXZbxXTZz1EBg8cBh+A0s/jW6broBrW36P+yW7 MCIwoW1vvS3B6FtiUDB9jXbgKWINJymp5gaGm8TuziSrka9epcNI9FWFMPhq78UaA1K2 0CSQ== X-Gm-Message-State: ABuFfohp7H7EdnSyMXkOQkthJuDAHRLCmHBmZk2b9m2p2gylQKon4vuL QPIcba5w6LIfcGWHgPT2VD4EWbaSGB8= X-Google-Smtp-Source: ACcGV63cFvJpu/QqPUDCpun/8CrSgausQgcZ4B/XYnwjKyfTb7dJ8pV41Qf4V6dImHciIzXpxw5G6w== X-Received: by 2002:a65:4783:: with SMTP id e3-v6mr3918965pgs.12.1539316937184; Thu, 11 Oct 2018 21:02:17 -0700 (PDT) Received: from localhost.localdomain (c-69-181-54-242.hsd1.ca.comcast.net. [69.181.54.242]) by smtp.gmail.com with ESMTPSA id p62-v6sm43481502pfp.111.2018.10.11.21.02.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 11 Oct 2018 21:02:16 -0700 (PDT) From: Aman Gupta To: ffmpeg-devel@ffmpeg.org Date: Thu, 11 Oct 2018 21:02:04 -0700 Message-Id: <20181012040204.21579-5-ffmpeg@tmm1.net> X-Mailer: git-send-email 2.15.2 (Apple Git-101.1) In-Reply-To: <20181012040204.21579-1-ffmpeg@tmm1.net> References: <20181012040204.21579-1-ffmpeg@tmm1.net> Subject: [FFmpeg-devel] [PATCH 5/5] avcodec/cbs: ensure user_data is padded for GBC parsing X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Aman Gupta MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" From: Aman Gupta Fixes crash noticed in the cbs_metadata patchset. ====ERROR: AddressSanitizer: heap-buffer-overflow on address 0x609000026c89 at pc 0x00010725d37b bp 0x7ffeea04e750 sp 0x7ffeea04e748 READ of size 4 at 0x609000026c89 thread T0 #0 0x10725d37a in ff_cbs_read_unsigned get_bits.h:274 #1 0x1072d2767 in ff_cbs_read_a53_user_data cbs_misc_syntax_template.c:119 #2 0x1078251a7 in h264_metadata_filter h264_metadata_bsf.c:595 #3 0x105c1321d in output_packet ffmpeg.c:853 0x609000026c89 is located 1 bytes to the right of 8-byte region [0x609000026c80,0x609000026c88) allocated by thread T0 here: #0 0x10aef08d7 in wrap_posix_memalign (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x578d7) #1 0x10aca95e6 in av_malloc mem.c:87 #2 0x10ac545fe in av_buffer_allocz buffer.c:72 #3 0x107263b27 in cbs_h264_read_nal_unit cbs_h264_syntax_template.c:722 #4 0x10725b688 in cbs_read_fragment_content cbs.c:155 Signed-off-by: Aman Gupta --- libavcodec/cbs_h264_syntax_template.c | 2 +- libavcodec/cbs_mpeg2_syntax_template.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/cbs_h264_syntax_template.c b/libavcodec/cbs_h264_syntax_template.c index 106da0630e..1c8d7d5eae 100644 --- a/libavcodec/cbs_h264_syntax_template.c +++ b/libavcodec/cbs_h264_syntax_template.c @@ -725,7 +725,7 @@ static int FUNC(sei_user_data_registered)(CodedBitstreamContext *ctx, RWContext *payload_size = i + current->data_length; #endif - allocate(current->data, current->data_length); + allocate(current->data, current->data_length + AV_INPUT_BUFFER_PADDING_SIZE); for (j = 0; j < current->data_length; j++) xu(8, itu_t_t35_payload_byte[i], current->data[j], 0x00, 0xff, 1, i + j); diff --git a/libavcodec/cbs_mpeg2_syntax_template.c b/libavcodec/cbs_mpeg2_syntax_template.c index 8b5d35437e..88cf453b17 100644 --- a/libavcodec/cbs_mpeg2_syntax_template.c +++ b/libavcodec/cbs_mpeg2_syntax_template.c @@ -71,7 +71,7 @@ static int FUNC(user_data)(CodedBitstreamContext *ctx, RWContext *rw, av_assert0(k % 8 == 0); current->user_data_length = k /= 8; if (k > 0) { - current->user_data_ref = av_buffer_alloc(k); + current->user_data_ref = av_buffer_allocz(k + AV_INPUT_BUFFER_PADDING_SIZE); if (!current->user_data_ref) return AVERROR(ENOMEM); current->user_data = current->user_data_ref->data;