[FFmpeg-devel] avformat/aviobuf: Delay buffer downsizing until asserts are met

Submitted by Michael Niedermayer on June 9, 2019, 8:43 p.m.

Details

Message ID 20190609204319.3004-1-michael@niedermayer.cc
State Accepted
Commit 0334632d5c02720f1829d59cd20c009584b5b163
Headers show

Commit Message

Michael Niedermayer June 9, 2019, 8:43 p.m.
Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/aviobuf.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Andreas Rheinhardt June 17, 2019, 11:12 p.m.
Michael Niedermayer:
> Fixes: Assertion failure
> Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
> 
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/aviobuf.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
> index 5a33f82950..6a5cd97b0a 100644
> --- a/libavformat/aviobuf.c
> +++ b/libavformat/aviobuf.c
> @@ -570,7 +570,7 @@ static void fill_buffer(AVIOContext *s)
>      }
>  
>      /* make buffer smaller in case it ended up large after probing */
> -    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size) {
> +    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size && len >= s->orig_buffer_size) {
>          if (dst == s->buffer && s->buf_ptr != dst) {
>              int ret = ffio_set_buf_size(s, s->orig_buffer_size);
>              if (ret < 0)
> @@ -578,7 +578,6 @@ static void fill_buffer(AVIOContext *s)
>  
>              s->checksum_ptr = dst = s->buffer;
>          }
> -        av_assert0(len >= s->orig_buffer_size);
>          len = s->orig_buffer_size;
>      }
>  
> 
I just noticed that ticket #7094 is about this assert. Could you test
whether everything works fine with your fix applied (and then mention
said this ticket in the commit message)?

- Andreas
Michael Niedermayer June 30, 2019, 12:27 p.m.
On Mon, Jun 17, 2019 at 11:12:00PM +0000, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > Fixes: Assertion failure
> > Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
> > 
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/aviobuf.c | 3 +--
> >  1 file changed, 1 insertion(+), 2 deletions(-)
> > 
> > diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
> > index 5a33f82950..6a5cd97b0a 100644
> > --- a/libavformat/aviobuf.c
> > +++ b/libavformat/aviobuf.c
> > @@ -570,7 +570,7 @@ static void fill_buffer(AVIOContext *s)
> >      }
> >  
> >      /* make buffer smaller in case it ended up large after probing */
> > -    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size) {
> > +    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size && len >= s->orig_buffer_size) {
> >          if (dst == s->buffer && s->buf_ptr != dst) {
> >              int ret = ffio_set_buf_size(s, s->orig_buffer_size);
> >              if (ret < 0)
> > @@ -578,7 +578,6 @@ static void fill_buffer(AVIOContext *s)
> >  
> >              s->checksum_ptr = dst = s->buffer;
> >          }
> > -        av_assert0(len >= s->orig_buffer_size);
> >          len = s->orig_buffer_size;
> >      }
> >  
> > 
> I just noticed that ticket #7094 is about this assert. Could you test
> whether everything works fine with your fix applied (and then mention
> said this ticket in the commit message)?

The ticket does not contain a full testcase, just a code snippet,
and the person reporting the issue has not yet replied
I suggest we apply this fix with a "May fix Ticket7094"


[...]
Andreas Rheinhardt June 30, 2019, 1:07 p.m.
Michael Niedermayer:
> On Mon, Jun 17, 2019 at 11:12:00PM +0000, Andreas Rheinhardt wrote:
>> Michael Niedermayer:
>>> Fixes: Assertion failure
>>> Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
>>>
>>> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>>> ---
>>>  libavformat/aviobuf.c | 3 +--
>>>  1 file changed, 1 insertion(+), 2 deletions(-)
>>>
>>> diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
>>> index 5a33f82950..6a5cd97b0a 100644
>>> --- a/libavformat/aviobuf.c
>>> +++ b/libavformat/aviobuf.c
>>> @@ -570,7 +570,7 @@ static void fill_buffer(AVIOContext *s)
>>>      }
>>>  
>>>      /* make buffer smaller in case it ended up large after probing */
>>> -    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size) {
>>> +    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size && len >= s->orig_buffer_size) {
>>>          if (dst == s->buffer && s->buf_ptr != dst) {
>>>              int ret = ffio_set_buf_size(s, s->orig_buffer_size);
>>>              if (ret < 0)
>>> @@ -578,7 +578,6 @@ static void fill_buffer(AVIOContext *s)
>>>  
>>>              s->checksum_ptr = dst = s->buffer;
>>>          }
>>> -        av_assert0(len >= s->orig_buffer_size);
>>>          len = s->orig_buffer_size;
>>>      }
>>>  
>>>
>> I just noticed that ticket #7094 is about this assert. Could you test
>> whether everything works fine with your fix applied (and then mention
>> said this ticket in the commit message)?
> 
> The ticket does not contain a full testcase, just a code snippet,
> and the person reporting the issue has not yet replied
> I suggest we apply this fix with a "May fix Ticket7094"
> 
> 
Agreed.

- Andreas
Michael Niedermayer June 30, 2019, 3:45 p.m.
On Sun, Jun 30, 2019 at 01:07:00PM +0000, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > On Mon, Jun 17, 2019 at 11:12:00PM +0000, Andreas Rheinhardt wrote:
> >> Michael Niedermayer:
> >>> Fixes: Assertion failure
> >>> Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
> >>>
> >>> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> >>> ---
> >>>  libavformat/aviobuf.c | 3 +--
> >>>  1 file changed, 1 insertion(+), 2 deletions(-)
> >>>
> >>> diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
> >>> index 5a33f82950..6a5cd97b0a 100644
> >>> --- a/libavformat/aviobuf.c
> >>> +++ b/libavformat/aviobuf.c
> >>> @@ -570,7 +570,7 @@ static void fill_buffer(AVIOContext *s)
> >>>      }
> >>>  
> >>>      /* make buffer smaller in case it ended up large after probing */
> >>> -    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size) {
> >>> +    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size && len >= s->orig_buffer_size) {
> >>>          if (dst == s->buffer && s->buf_ptr != dst) {
> >>>              int ret = ffio_set_buf_size(s, s->orig_buffer_size);
> >>>              if (ret < 0)
> >>> @@ -578,7 +578,6 @@ static void fill_buffer(AVIOContext *s)
> >>>  
> >>>              s->checksum_ptr = dst = s->buffer;
> >>>          }
> >>> -        av_assert0(len >= s->orig_buffer_size);
> >>>          len = s->orig_buffer_size;
> >>>      }
> >>>  
> >>>
> >> I just noticed that ticket #7094 is about this assert. Could you test
> >> whether everything works fine with your fix applied (and then mention
> >> said this ticket in the commit message)?
> > 
> > The ticket does not contain a full testcase, just a code snippet,
> > and the person reporting the issue has not yet replied
> > I suggest we apply this fix with a "May fix Ticket7094"
> > 
> > 
> Agreed.

will apply

thanks

[...]

Patch hide | download patch | download mbox

diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 5a33f82950..6a5cd97b0a 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -570,7 +570,7 @@  static void fill_buffer(AVIOContext *s)
     }
 
     /* make buffer smaller in case it ended up large after probing */
-    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size) {
+    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size && len >= s->orig_buffer_size) {
         if (dst == s->buffer && s->buf_ptr != dst) {
             int ret = ffio_set_buf_size(s, s->orig_buffer_size);
             if (ret < 0)
@@ -578,7 +578,6 @@  static void fill_buffer(AVIOContext *s)
 
             s->checksum_ptr = dst = s->buffer;
         }
-        av_assert0(len >= s->orig_buffer_size);
         len = s->orig_buffer_size;
     }