mbox series

[FFmpeg-devel,v3,00/11] libavformat/asf: fix handling of byte array length values

Message ID pull.12.v3.ffstaging.FFmpeg.1651978882.ffmpegagent@gmail.com
Headers show
Series libavformat/asf: fix handling of byte array length values | expand

Message

softworkz May 8, 2022, 3:01 a.m. UTC
The spec allows attachment sizes of up to UINT32_MAX while we can handle
only sizes up to INT32_MAX (in downstream code)

The debug.assert in get_tag didn't really address this, and truncating the
value_len in calling methods cannot be used because the length value is
required in order to continue parsing. This adds a check with log message in
ff_asf_handle_byte_array to handle those (rare) cases.

v2: Rebased & PING v3: Adjustments suggested by Michael

softworkz (11):
  libavformat/asf: fix handling of byte array length values
  libavformat/asfdec: fix get_value return type and add checks for
  libavformat/asfdec: fix type of value_len
  libavformat/asfdec: fixing get_tag
  libavformat/asfdec: implement parsing of GUID values
  libavformat/asfdec: remove unused parameters
  libavformat/asfdec: fix macro definition and use
  libavformat/asfdec: remove variable redefinition in inner scope
  libavformat/asfdec: ensure variables are initialized
  libavformat/asfdec: fix parameter type in asf_read_stream_propertie()
  libavformat/asfdec: fix variable types and add checks for unsupported
    values

 libavformat/asf.c      |   8 +-
 libavformat/asf.h      |   2 +-
 libavformat/asfdec_f.c | 368 ++++++++++++++++++++++++++---------------
 3 files changed, 244 insertions(+), 134 deletions(-)


base-commit: f1c19867d72a14699277175101b2bcf1e333af88
Published-As: https://github.com/ffstaging/FFmpeg/releases/tag/pr-ffstaging-12%2Fsoftworkz%2Fmaster-upstream_asf_4-v3
Fetch-It-Via: git fetch https://github.com/ffstaging/FFmpeg pr-ffstaging-12/softworkz/master-upstream_asf_4-v3
Pull-Request: https://github.com/ffstaging/FFmpeg/pull/12

Range-diff vs v2:

  1:  0056a93a34 !  1:  b5c56bf5d0 libavformat/asf: fix handling of byte array length values
     @@ libavformat/asf.c: static int get_id3_tag(AVFormatContext *s, int len)
      +    }
      +
           if (!strcmp(name, "WM/Picture")) // handle cover art
     --        return asf_read_picture(s, val_len);
     -+        return asf_read_picture(s, (int)val_len);
     +         return asf_read_picture(s, val_len);
           else if (!strcmp(name, "ID3")) // handle ID3 tag
     --        return get_id3_tag(s, val_len);
     -+        return get_id3_tag(s, (int)val_len);
     +         return get_id3_tag(s, val_len);
       
     -+    av_log(s, AV_LOG_VERBOSE, "Unsupported byte array in tag %s.\n", name);
     ++    av_log(s, AV_LOG_DEBUG, "Unsupported byte array in tag %s.\n", name);
           return 1;
       }
      
  2:  a35b7c87d4 !  2:  e6aa0fb7f3 libavformat/asfdec: fix get_value return type and add checks for
     @@ libavformat/asfdec_f.c: static int asf_probe(const AVProbeData *pd)
       {
           switch (type) {
           case ASF_BOOL:
     +@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size)
     + {
     +     AVIOContext *pb = s->pb;
     +     ASFContext *asf = s->priv_data;
     ++    uint64_t dar_num = 0;
     ++    uint64_t dar_den = 0;
     +     int desc_count, i, ret;
     + 
     +     desc_count = avio_rl16(pb);
      @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size)
               /* My sample has that stream set to 0 maybe that mean the container.
                * ASF stream count starts at 1. I am using 0 to the container value
     @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s,
      -        else if (!strcmp(name, "AspectRatioY"))
      -            asf->dar[0].den = get_value(s->pb, value_type, 32);
      +        if (!strcmp(name, "AspectRatioX")) {
     -+            const uint64_t value = get_value(s->pb, value_type, 32);
     -+            if (value > INT32_MAX) {
     -+                av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", value);
     ++            dar_num = get_value(s->pb, value_type, 32);
     ++            if (dar_num > INT64_MAX) {
     ++                av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num);
      +                return AVERROR(ENOTSUP);
      +            }
     -+            asf->dar[0].num = (int)value;
      +        }
      +        else if (!strcmp(name, "AspectRatioY")) {
     -+            const uint64_t value = get_value(s->pb, value_type, 32);
     -+            if (value > INT32_MAX) {
     -+                av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", value);
     ++            dar_den = get_value(s->pb, value_type, 32);
     ++            if (dar_den > INT64_MAX) {
     ++                av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den);
      +                return AVERROR(ENOTSUP);
      +            }
     -+            asf->dar[0].den = (int)value;
      +        }
               else
                   get_tag(s, name, value_type, value_len, 32);
           }
     + 
     ++    if (dar_num && dar_den)
     ++        av_reduce(&asf->dar[0].num, &asf->dar[0].den, dar_num, dar_den, INT_MAX);
     ++
     +     return 0;
     + }
     + 
     +@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size)
     + {
     +     AVIOContext *pb = s->pb;
     +     ASFContext *asf = s->priv_data;
     ++    uint64_t dar_num[128] = {0};
     ++    uint64_t dar_den[128] = {0};
     +     int n, stream_num, name_len_utf16, name_len_utf8, value_len;
     +     int ret, i;
     +     n = avio_rl16(pb);
      @@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size)
     +         av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n",
                       i, stream_num, name_len_utf16, value_type, value_len, name);
       
     -         if (!strcmp(name, "AspectRatioX")){
     +-        if (!strcmp(name, "AspectRatioX")){
      -            int aspect_x = get_value(s->pb, value_type, 16);
     -+            const uint64_t aspect_x = get_value(s->pb, value_type, 16);
     -+            if (aspect_x > INT32_MAX) {
     -+                av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", aspect_x);
     -+                return AVERROR(ENOTSUP);
     -+            }
     -             if(stream_num < 128)
     +-            if(stream_num < 128)
      -                asf->dar[stream_num].num = aspect_x;
     -+                asf->dar[stream_num].num = (int)aspect_x;
     -         } else if(!strcmp(name, "AspectRatioY")){
     +-        } else if(!strcmp(name, "AspectRatioY")){
      -            int aspect_y = get_value(s->pb, value_type, 16);
     -+            const uint64_t aspect_y = get_value(s->pb, value_type, 16);
     -+            if (aspect_y > INT32_MAX) {
     -+                av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", aspect_y);
     +-            if(stream_num < 128)
     +-                asf->dar[stream_num].den = aspect_y;
     +-        } else {
     ++        if (!strcmp(name, "AspectRatioX") && stream_num < 128) {
     ++            dar_num[stream_num] = get_value(s->pb, value_type, 16);
     ++            if (dar_num[stream_num] > INT64_MAX) {
     ++                av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num[stream_num]);
      +                return AVERROR(ENOTSUP);
      +            }
     -             if(stream_num < 128)
     --                asf->dar[stream_num].den = aspect_y;
     -+                asf->dar[stream_num].den = (int)aspect_y;
     -         } else {
     ++        }
     ++        else if (!strcmp(name, "AspectRatioY") && stream_num < 128) {
     ++            dar_den[stream_num] = get_value(s->pb, value_type, 16);
     ++            if (dar_den[stream_num] > INT64_MAX) {
     ++                av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den[stream_num]);
     ++                return AVERROR(ENOTSUP);
     ++            }
     ++        } else
                   get_tag(s, name, value_type, value_len, 16);
     ++
     ++
     ++        if (stream_num < 128 && dar_num[stream_num] && dar_den[stream_num]) {
     ++            av_reduce(&asf->dar[stream_num].num, &asf->dar[stream_num].den, dar_num[stream_num], dar_den[stream_num], INT_MAX);
     ++            dar_num[stream_num] = 0;
     ++            dar_den[stream_num] = 0;
               }
     ++
     +         av_freep(&name);
     +     }
     + 
  3:  b8039dc4cf !  3:  b84474d729 libavformat/asfdec: fix type of value_len
     @@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex
           len1 = avio_rl16(pb);
           len2 = avio_rl16(pb);
      @@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size)
     - {
     -     AVIOContext *pb = s->pb;
           ASFContext *asf = s->priv_data;
     +     uint64_t dar_num[128] = {0};
     +     uint64_t dar_den[128] = {0};
      -    int n, stream_num, name_len_utf16, name_len_utf8, value_len;
      +    int n, name_len_utf8;
      +    uint16_t stream_num, name_len_utf16, value_type;
  4:  6e19df6e89 =  4:  a54feb51a1 libavformat/asfdec: fixing get_tag
  5:  0f3c417efe =  5:  e14beb2c15 libavformat/asfdec: implement parsing of GUID values
  6:  3bee11e40f =  6:  06062da88b libavformat/asfdec: remove unused parameters
  7:  ca9bbc79de =  7:  273823a5b4 libavformat/asfdec: fix macro definition and use
  8:  238290bbce =  8:  aaa37aca21 libavformat/asfdec: remove variable redefinition in inner scope
  9:  654e44d526 =  9:  6aedb68b76 libavformat/asfdec: ensure variables are initialized
 10:  d461f039d2 = 10:  28ebbe7289 libavformat/asfdec: fix parameter type in asf_read_stream_propertie()
 11:  f606f322bb ! 11:  bbeee5f2da libavformat/asfdec: fix variable types and add checks for unsupported values
     @@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex
               if (stream_num < 128 && i < FF_ARRAY_ELEMS(asf->streams[stream_num].payload)) {
                   ASFPayload *p = &asf->streams[stream_num].payload[i];
      @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s)
     - {
     -     AVIOContext *pb = s->pb;
           ASFContext *asf = s->priv_data;
     +     uint64_t dar_num = 0;
     +     uint64_t dar_den = 0;
      -    int desc_count, i, ret;
      +    uint16_t desc_count, i;
      +    int ret;
     @@ libavformat/asfdec_f.c: static int asf_read_language_list(AVFormatContext *s)
                   av_strlcpy(asf->stream_languages[j], lang,
                              sizeof(*asf->stream_languages));
      @@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s)
     - {
     -     AVIOContext *pb = s->pb;
           ASFContext *asf = s->priv_data;
     +     uint64_t dar_num[128] = {0};
     +     uint64_t dar_den[128] = {0};
      -    int n, name_len_utf8;
      -    uint16_t stream_num, name_len_utf16, value_type;
      +    int name_len_utf8;