From patchwork Mon Jan 8 22:34:21 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jacob Trimble X-Patchwork-Id: 7208 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.2.78.2 with SMTP id r2csp3189336jaa; Mon, 8 Jan 2018 14:34:31 -0800 (PST) X-Google-Smtp-Source: ACJfBou53S74A/h99cB3Fwg7MrcWqrplImpsRV1ywc6DnjFeTHPbwv4bY0tXa2pTIfb2WY0gsuKX X-Received: by 10.28.103.196 with SMTP id b187mr11182887wmc.127.1515450871745; Mon, 08 Jan 2018 14:34:31 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1515450871; cv=none; d=google.com; s=arc-20160816; b=dnKmc3yjUp0sGcM6lqULm/wJG4wTOUGSAekGYlMvmteNHHvj8UR7wu0wSjUjQJqy+7 sXUqyknoyJCaWtlj0sHN8klPx/ZaTFb/6Qc+k4YsKRLsA7GV/rxikK7hQCt9Ob/aN9Os cKuEPOXBRVI5oaTbfERVzlDNUMmkpg2ImOECkFHENlepg8pp6IZbqKtbLLgQHcOpBYEV Psn7ysuzfO+Gb53YOIRy7a9T7r8slDanUlK7Rbvqx52OT/NeORmfNHbRTY/tbgtErjxX LCNYSL3B5vov3AmsGULjVoF0AzJ4G5LLJexRLCYmg4335f4yQokvnV+K4d4CbmwzdRUi fvnw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence:subject:to :message-id:date:from:references:in-reply-to:mime-version :dkim-signature:delivered-to:arc-authentication-results; bh=lb8UWfhL4M4UCmTBydYJtwqGVtYQsiwLHgo+RLcUOAc=; b=tRCbHG6O9daUGscb+7ZVJCRVP0XLTbbS/kJ9/AVoakVSJnf7OeyE/Vzk9tUuj0zAe6 upGUe2XyImq6xBcbEqaoFJSNAgZeajhZoV7pyPpjKx1tep+jgTFYMHVp51BXbP0YQ8uo 5LXC+mSjnxw5rE21GSwX0lXwPmkhvlFiSWSJT/1eGeFi8vHcAP58eVd2NHXlC6/49/1K oBAhdEuqOULJ5aEzbbyzSigvO4W++MwlUT8BleP+uRL41LX0wRRnrJ1bbBtpAchTMETK /1eX4MjOn16lR2ZkOBcJccbQXM5ppP9Hx+r4SPWIPQ2ZZ5j+EBFQyWwIhW9rWwcwD5cS 1EJQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@google.com header.s=20161025 header.b=vZdnJJNo; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id j25si9802594wrc.132.2018.01.08.14.34.31; Mon, 08 Jan 2018 14:34:31 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@google.com header.s=20161025 header.b=vZdnJJNo; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0960C689AE8; Tue, 9 Jan 2018 00:34:29 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-vk0-f47.google.com (mail-vk0-f47.google.com [209.85.213.47]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id D7F486899AA for ; Tue, 9 Jan 2018 00:34:22 +0200 (EET) Received: by mail-vk0-f47.google.com with SMTP id w75so8294745vkd.7 for ; Mon, 08 Jan 2018 14:34:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=yLfy8v0wR7WQfkppUXjkLgszwT9f521LvskCPulBTno=; b=vZdnJJNoibmzTW7viAQQSRysaCsnxNWw7NXc+3JZU1PHpHjHuS3YRIJkcVKTsw1gQR UouTvN8SikyeELikHkTBI18G5pd+0kCSRqKOOdcrPhNARWflV1oJB0PEbUkmAQoF0AgL /ROsv8ytuTPnL8fTfA/rtre0BXUiprYgNFf9yl4yg+pHwlAaZ6MdX06Ew1Uo7ymHuAVA EFw2vfk3Uoxd5962PwouDwUXC3eulTt236SK12Q0MuOSSkNz35nhbkJINW62yB5qL9fy GJM0hMqvpOJm0N4cNXBNRegAifoLmC9b8f/5l+HaNxmTgIdds3wdtyxzu3vsFDQjhPVk LJGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=yLfy8v0wR7WQfkppUXjkLgszwT9f521LvskCPulBTno=; b=hYq09GueQjz2nmY++C8EmmoUJD3O7BKB7nxb8mvz68+0fYkB5w6s4K/e3zrQ6v9h9o yNBMtD6GZw6JUqtXibmXaNyx2LxEEIWoighCIJeSD2y/4HOblJrb5j7IX9JdY6wM7tKz 9mYOm1HnAupPF4OOsMJebDK+0PHwzG/oMGptPwiCNwsIgIic7xOfNqHbziu74km9TDVp u1judI0ytixV5pTrLPi0GDm9PEd91bwxGZj1dd+d6A0+EOM3KrarxAPfygvVi2Wo6LPz XNMBLgC34HAy3vngXj4sfv925vlRj4InYI9kXuguSvhWoCejdIBN59ETPY3vllVoPW8l SiNg== X-Gm-Message-State: AKwxytc3YMCkT/i4MNlBlRJMAerKeJRGwBc7PCtNXqUlQ8K2ahjDbUCH dIBdEwhFiTKiUbpERmiZMfQG5TCIW/D21Mv6kFl38U2o X-Received: by 10.31.149.144 with SMTP id x138mr11386758vkd.121.1515450862234; Mon, 08 Jan 2018 14:34:22 -0800 (PST) MIME-Version: 1.0 Received: by 10.103.214.138 with HTTP; Mon, 8 Jan 2018 14:34:21 -0800 (PST) In-Reply-To: References: <20180105194928.104085-1-modmaker@google.com> <20180105194928.104085-2-modmaker@google.com> From: Jacob Trimble Date: Mon, 8 Jan 2018 14:34:21 -0800 Message-ID: To: FFmpeg development discussions and patches Subject: Re: [FFmpeg-devel] [PATCH 2/3] avformat/mov: Fix parsing of saio/siaz atoms in encrypted content. X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" On Fri, Jan 5, 2018 at 3:41 PM, Carl Eugen Hoyos wrote: > 2018-01-05 23:58 GMT+01:00 Jacob Trimble : >> On Fri, Jan 5, 2018 at 2:01 PM, Carl Eugen Hoyos wrote: >>> 2018-01-05 22:29 GMT+01:00 Jacob Trimble : >>>> On Fri, Jan 5, 2018 at 12:41 PM, Carl Eugen Hoyos wrote: >>>>> 2018-01-05 20:49 GMT+01:00 Jacob Trimble : >>>>> >>>>>> + entry_count = avio_rb32(pb); >>>>>> + encryption_index->auxiliary_offsets = av_malloc_array(sizeof(size_t), entry_count); >>>>> >>>>> (sizeof(variable) instead of sizeof(type), please.) >>>>> >>>>> But since this could be used for a dos attack, please change this >>>>> to something similar to 1112ba01. >>>>> If it is easy to avoid it, very short files should not allocate >>>>> gigabytes. >>>> >>>> Switched to calculating the size based on the number of remaining >>>> bytes and returning an error if it doesn't match what is read. >>> >>> Sorry if I miss something: >>> >>>> + entry_count = (atom.size - 8 - (has_saio_type ? 8 : 0)) / (version == 0 ? 4 : 8); >>>> + if (avio_rb32(pb) != entry_count) { >>>> + av_log(c->fc, AV_LOG_ERROR, "incorrect entry_count in saio\n"); >>>> + return AVERROR_INVALIDDATA; >>>> + } >>>> + encryption_index->auxiliary_offsets = >>>> + av_malloc_array(sizeof(*encryption_index->auxiliary_offsets), entry_count); >>> >>> Does this avoid a 1G allocation for a file of a few bytes? >>> >>> Didn't you simply increase the number of needed bytes to change in a valid >>> mov file to behave maliciously from one to two? >> >> From what I can tell, the mov_read_default method (which is what reads >> child atoms) will verify "atom.size" to fit inside the parent atom. >> This means that for "atom.size" to be excessively large for the file >> size, the input would need to be non-seekable (since I think the >> top-level atom uses the file size) and all the atoms would need to >> have invalid sizes. > > (I did not check this but I am not convinced the sample I fixed last > week is so sophisticated.) > >> But technically I guess it is possible. > > Thank you. > >> But this is basically malloc some number of bytes then read that many >> bytes. The only alternative I can think of (in the face of >> non-seekable inputs) is to try-read in chunks until we hit EOF or the >> end of the expected size. This seems like a lot of extra work that is > >> not mirrored elsewhere. > > On the contrary. > > But you are right, I forgot to write that you have to add an "if (!eof)" > to the reading loops, see the function that above commit changed. > >> There are several cases where this isn't explicitly checked. > > Yes, and they will be fixed, please don't add another one. > >> Also, how does this attack work? If the number is way too big, well >> get EOM and error out. > > Which not only causes dos but also makes checking for other (if you > like: more dangerous) issues more difficult which is bad. We already > know that there are cases where the issue is hard to avoid, I believe > this is not such a case. > > It is possible to create (valid) samples that allocate a huge amount > of memory but very small files should not immediately allocate an > amount of several G. Done. > > Carl Eugen > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel From 524f81fd4b7ab31c576271f2747087bd16ca8734 Mon Sep 17 00:00:00 2001 From: Jacob Trimble Date: Wed, 6 Dec 2017 16:17:54 -0800 Subject: [PATCH] avformat/mov: Fix parsing of saio/siaz atoms in encrypted content. This doesn't support saio atoms with more than one offset. Signed-off-by: Jacob Trimble --- libavformat/isom.h | 6 ++ libavformat/mov.c | 232 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 238 insertions(+) diff --git a/libavformat/isom.h b/libavformat/isom.h index 3794b1f0fd..3de8053da2 100644 --- a/libavformat/isom.h +++ b/libavformat/isom.h @@ -114,6 +114,12 @@ typedef struct MOVEncryptionIndex { // settings will be used. unsigned int nb_encrypted_samples; AVEncryptionInfo **encrypted_samples; + + uint8_t* auxiliary_info_sizes; + size_t auxiliary_info_sample_count; + uint8_t auxiliary_info_default_size; + size_t* auxiliary_offsets; ///< Absolute seek position + size_t auxiliary_offsets_count; } MOVEncryptionIndex; typedef struct MOVFragmentStreamInfo { diff --git a/libavformat/mov.c b/libavformat/mov.c index 4aeb379216..71cc9a3af3 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5863,6 +5863,223 @@ end: return ret; } +static int mov_parse_auxiliary_info(MOVContext *c, MOVStreamContext *sc, AVIOContext *pb, MOVEncryptionIndex *encryption_index) +{ + AVEncryptionInfo **sample, **encrypted_samples; + int64_t prev_pos; + size_t sample_count, sample_info_size, i; + int ret = 0; + unsigned int alloc_size = 0; + + if (encryption_index->nb_encrypted_samples) + return 0; + sample_count = encryption_index->auxiliary_info_sample_count; + if (encryption_index->auxiliary_offsets_count != 1) { + av_log(c->fc, AV_LOG_ERROR, "Multiple auxiliary info chunks are not supported\n"); + return AVERROR_PATCHWELCOME; + } + + prev_pos = avio_tell(pb); + if (avio_seek(pb, encryption_index->auxiliary_offsets[0], SEEK_SET) != encryption_index->auxiliary_offsets[i]) { + av_log(c->fc, AV_LOG_INFO, "Failed to seek for auxiliary info, will only parse senc atoms for encryption info\n"); + goto finish; + } + + for (i = 0; i < sample_count && !pb->eof_reached; i++) { + unsigned int min_samples = FFMIN(FFMAX(i, 1024 * 1024), sample_count); + encrypted_samples = av_fast_realloc(encryption_index->encrypted_samples, &alloc_size, + min_samples * sizeof(*encrypted_samples)); + if (!encrypted_samples) { + ret = AVERROR(ENOMEM); + goto finish; + } + encryption_index->encrypted_samples = encrypted_samples; + + sample = &encryption_index->encrypted_samples[i]; + sample_info_size = encryption_index->auxiliary_info_default_size + ? encryption_index->auxiliary_info_default_size + : encryption_index->auxiliary_info_sizes[i]; + + ret = mov_read_sample_encryption_info(c, pb, sc, sample, sample_info_size > sc->cenc.per_sample_iv_size); + if (ret < 0) + goto finish; + } + if (pb->eof_reached) { + av_log(c->fc, AV_LOG_ERROR, "Hit EOF while reading auxiliary info\n"); + ret = AVERROR_INVALIDDATA; + } else { + encryption_index->nb_encrypted_samples = sample_count; + } + +finish: + avio_seek(pb, prev_pos, SEEK_SET); + if (ret < 0) { + for (; i > 0; i--) { + av_encryption_info_free(encryption_index->encrypted_samples[i - 1]); + } + av_freep(&encryption_index->encrypted_samples); + } + return ret; +} + +/** + * Tries to read the given number of bytes from the stream and puts it in a + * newly allocated buffer. This reads in small chunks to avoid allocating large + * memory if the file contains an invalid/malicious size value. + */ +static int mov_try_read_block(AVIOContext *pb, size_t size, uint8_t **data) +{ + uint8_t *buffer = NULL; + unsigned int alloc_size = 0, offset = 0; + while (offset < size) { + uint8_t *new_buffer = av_fast_realloc(buffer, &alloc_size, alloc_size + 1024 * 1024); + unsigned int to_read = FFMIN(size, alloc_size) - offset; + if (!new_buffer) { + av_free(buffer); + return AVERROR(ENOMEM); + } + buffer = new_buffer; + + if (avio_read(pb, buffer + offset, to_read) != to_read) { + av_free(buffer); + return AVERROR_INVALIDDATA; + } + offset += to_read; + } + + *data = buffer; + return 0; +} + +static int mov_read_saiz(MOVContext *c, AVIOContext *pb, MOVAtom atom) +{ + MOVEncryptionIndex *encryption_index; + MOVStreamContext *sc; + int ret; + unsigned int sample_count; + + ret = get_current_encryption_info(c, &encryption_index, &sc); + if (ret != 1) + return ret; + + if (encryption_index->nb_encrypted_samples) { + // This can happen if we have both saio/saiz and senc atoms. + av_log(c->fc, AV_LOG_DEBUG, "Ignoring duplicate encryption info in saiz\n"); + return 0; + } + + if (encryption_index->auxiliary_info_sample_count) { + av_log(c->fc, AV_LOG_ERROR, "Duplicate saiz atom\n"); + return AVERROR_INVALIDDATA; + } + + avio_r8(pb); /* version */ + if (avio_rb24(pb) & 0x01) { /* flags */ + if (avio_rb32(pb) != sc->cenc.default_encrypted_sample->scheme) { + av_log(c->fc, AV_LOG_DEBUG, "Ignoring saiz box with non-zero aux_info_type\n"); + return 0; + } + if (avio_rb32(pb) != 0) { + av_log(c->fc, AV_LOG_DEBUG, "Ignoring saiz box with non-zero aux_info_type_parameter\n"); + return 0; + } + } + + encryption_index->auxiliary_info_default_size = avio_r8(pb); + sample_count = avio_rb32(pb); + encryption_index->auxiliary_info_sample_count = sample_count; + + if (encryption_index->auxiliary_info_default_size == 0) { + ret = mov_try_read_block(pb, sample_count, &encryption_index->auxiliary_info_sizes); + if (ret < 0) { + av_log(c->fc, AV_LOG_ERROR, "Failed to read the auxiliary info\n"); + return ret; + } + } + + if (encryption_index->auxiliary_offsets_count) { + return mov_parse_auxiliary_info(c, sc, pb, encryption_index); + } + + return 0; +} + +static int mov_read_saio(MOVContext *c, AVIOContext *pb, MOVAtom atom) +{ + uint64_t *auxiliary_offsets; + MOVEncryptionIndex *encryption_index; + MOVStreamContext *sc; + int i, ret; + unsigned int version, entry_count, alloc_size = 0; + + ret = get_current_encryption_info(c, &encryption_index, &sc); + if (ret != 1) + return ret; + + if (encryption_index->nb_encrypted_samples) { + // This can happen if we have both saio/saiz and senc atoms. + av_log(c->fc, AV_LOG_DEBUG, "Ignoring duplicate encryption info in saio\n"); + return 0; + } + + if (encryption_index->auxiliary_offsets_count) { + av_log(c->fc, AV_LOG_ERROR, "Duplicate saio atom\n"); + return AVERROR_INVALIDDATA; + } + + version = avio_r8(pb); /* version */ + if (avio_rb24(pb) & 0x01) { /* flags */ + if (avio_rb32(pb) != sc->cenc.default_encrypted_sample->scheme) { + av_log(c->fc, AV_LOG_DEBUG, "Ignoring saio box with non-zero aux_info_type\n"); + return 0; + } + if (avio_rb32(pb) != 0) { + av_log(c->fc, AV_LOG_DEBUG, "Ignoring saio box with non-zero aux_info_type_parameter\n"); + return 0; + } + } + + entry_count = avio_rb32(pb); + encryption_index->auxiliary_offsets = + av_malloc_array(sizeof(*encryption_index->auxiliary_offsets), entry_count); + if (!encryption_index->auxiliary_offsets) + return AVERROR(ENOMEM); + + for (i = 0; i < entry_count && !pb->eof_reached; i++) { + unsigned int min_offsets = FFMIN(FFMAX(i, 1024 * 1024), entry_count); + auxiliary_offsets = av_fast_realloc( + encryption_index->auxiliary_offsets, &alloc_size, + min_offsets * sizeof(*auxiliary_offsets)); + if (!auxiliary_offsets) { + av_freep(&encryption_index->auxiliary_offsets); + return AVERROR(ENOMEM); + } + + if (version == 0) { + encryption_index->auxiliary_offsets[i] = avio_rb32(pb); + } else { + encryption_index->auxiliary_offsets[i] = avio_rb64(pb); + } + if (c->frag_index.current >= 0) { + encryption_index->auxiliary_offsets[i] += c->fragment.base_data_offset; + } + } + + if (pb->eof_reached) { + av_log(c->fc, AV_LOG_ERROR, "Hit EOF while reading saio\n"); + av_freep(&encryption_index->auxiliary_offsets); + return AVERROR_INVALIDDATA; + } + + encryption_index->auxiliary_offsets_count = entry_count; + + if (encryption_index->auxiliary_info_sample_count) { + return mov_parse_auxiliary_info(c, sc, pb, encryption_index); + } + + return 0; +} + static int mov_read_schm(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; @@ -6078,6 +6295,17 @@ static int cenc_filter(MOVContext *mov, MOVStreamContext *sc, AVPacket *pkt, int } if (encryption_index) { + if (encryption_index->auxiliary_info_sample_count && + !encryption_index->nb_encrypted_samples) { + av_log(mov->fc, AV_LOG_ERROR, "saiz atom found without saio\n"); + return AVERROR_INVALIDDATA; + } + if (encryption_index->auxiliary_offsets_count && + !encryption_index->nb_encrypted_samples) { + av_log(mov->fc, AV_LOG_ERROR, "saio atom found without saiz\n"); + return AVERROR_INVALIDDATA; + } + if (!encryption_index->nb_encrypted_samples) { // Full-sample encryption with default settings. encrypted_sample = sc->cenc.default_encrypted_sample; @@ -6222,6 +6450,8 @@ static const MOVParseTableEntry mov_default_parse_table[] = { { MKTAG('s','i','n','f'), mov_read_default }, { MKTAG('f','r','m','a'), mov_read_frma }, { MKTAG('s','e','n','c'), mov_read_senc }, +{ MKTAG('s','a','i','z'), mov_read_saiz }, +{ MKTAG('s','a','i','o'), mov_read_saio }, { MKTAG('s','c','h','m'), mov_read_schm }, { MKTAG('s','c','h','i'), mov_read_default }, { MKTAG('t','e','n','c'), mov_read_tenc }, @@ -6617,6 +6847,8 @@ static void mov_free_encryption_index(MOVEncryptionIndex **index) { av_encryption_info_free((*index)->encrypted_samples[i]); } av_freep(&(*index)->encrypted_samples); + av_freep(&(*index)->auxiliary_info_sizes); + av_freep(&(*index)->auxiliary_offsets); av_freep(index); } -- 2.16.0.rc0.223.g4a4ac83678-goog