From patchwork Sun May 8 03:01:11 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Karmani X-Patchwork-Id: 34703 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:a885:b0:7f:4be2:bd17 with SMTP id ca5csp2386826pzb; Sat, 7 May 2022 20:01:36 -0700 (PDT) X-Google-Smtp-Source: ABdhPJynSykU/UfoP0PxTO28clJVr0gaLj7XZrFT+Bxn6fvwckyCZatX+bH3liUTrdLAai/3QRPy X-Received: by 2002:a05:6402:1813:b0:425:adb9:4abd with SMTP id g19-20020a056402181300b00425adb94abdmr11060582edy.278.1651978895967; Sat, 07 May 2022 20:01:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651978895; cv=none; d=google.com; s=arc-20160816; b=oxgY0r4/SlcmMuroAeLZ7KFQwYCBmQhKDQnP79zQkA5+JzJBeO9v8ahQ5ov60L5l13 TcP7vaPX5KU8+0tCpZMkShQvjgYmu4brPH9HYz9oZlH2VwAXtTtZh1wSNcmf+pAEVber bIKRa9H+hisee7wKF8pXelVD6GSvqFhz8NH8XXFt7PnZQ3Fg7VIG6mxiRO7wSk2sr1l/ YeOeQbpOxyNgRgIU2O+i8CLIT9Vr/KYdl8UomcLDKKzZxByOFAPB2+O9uhxPbTQbUjCS uWPEMs2Z5ffCy/IWcDl/2XMN+TNHyjbJSxNVHOPkAVqVkTW7RBvs4GhRlMlTFZud+l50 zuBg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:to:mime-version:fcc:date:from:references :in-reply-to:message-id:dkim-signature:delivered-to; bh=jdhV33PMOKTPgrppHSRf+oLv9JX4mSIRTGrqM2tHdSQ=; b=WGgmudONDepZE620F94ToEgcwrz9shKhZnFYmMNvDmUH6qcT9hwA6O9/YhAIw7hRhF SXeNCji0OzLMKhwNuuFS35j+2Pk84ny34jhJCc3J+q4uWLml3zGG301h+FynhtlpIPE+ QTXmqBA5NMciim2xL0vfSJ1UhNitrq86LSVgzXP6UE4IhtKxyroPMFnr4hYyDvuTqbo6 1RuuLTeq3b3SAEgs0S9YeRXFNvaeY/aAgjfrQ+ETf7EZhy6cnsJ+omDvrhAkSgpcRL/A CFzTnZ7XM3+kFM4MRYV4lkK+0XImqyxxdkTWTSK1oAB8ZCIeIJCsOiINiOBYVdtUw++D tPIA== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=cCqfKPFH; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id f10-20020a17090624ca00b006f3b304d00dsi8874783ejb.720.2022.05.07.20.01.35; Sat, 07 May 2022 20:01:35 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=cCqfKPFH; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 758AE68B3A7; Sun, 8 May 2022 06:01:32 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id DA71A68A466 for ; Sun, 8 May 2022 06:01:25 +0300 (EEST) Received: by mail-pg1-f170.google.com with SMTP id v10so9274945pgl.11 for ; Sat, 07 May 2022 20:01:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=3Ts9i9Wmrgsi9F+7KJCOw3PMXHP/rGtpXIsPtuVj5+c=; b=cCqfKPFHCg/RrYdJ3vR9DzkP2yYcg0KBH0J5b5wfy+yEtnurcb/HJ2PuvmJDMX7scQ /4oPlBoeq1UVXYzmNbczflE/NIuAicxrlW8Kyg9fpf97Rnyk9UyGz9JB/Jpb4EXcDGZJ 68wOcdnZAZ0z1zkMqBDtbm0d2ExNUAFib5A40pYie4simVM0SI9oRhpw93KJydBuaYDQ ecO2KenRbaW3d8COa4DRA+QqO5LQWsLGGeuLdzlmKGd5FjBGOn6mR6Dm/+YQOsp3QMWy qGfAbJkdreTvnzOedWmxQK8T16UZT/yqOmzER107LePzSdbze/QvCaHxzID1G9CZiLNl kvkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=3Ts9i9Wmrgsi9F+7KJCOw3PMXHP/rGtpXIsPtuVj5+c=; b=XyGAP5f9x3bp9oFZBV6LdszciMFMmb36IzlbFVLLf25YDIx0wfgyufdzrn/cHhoPuj LECekPy8Z277N0ji7qo1NUTIJMlWZNljbXldkr9l2LUBXqZwB4OSUVdW55JtNuwwssFb phMROxtUY+yOSxyZOl0mCralFm7aTTFy+zdpS5I6IrXlkigJzEINRqhDxZ9/g5UHaBKr l1LHtaseaoQbQsglyVRsFrwNXOm/Je3mxQnq2exJYDNUKtpQBTJqZ2lzAGKFjkgOPN54 xI/1JFwfNd7SccdDVcCwcNc2wwhsgryqUtGDupsIsM2iWQ1xgZrGwIq/ler1r1UNK0nF A5/A== X-Gm-Message-State: AOAM533iTQma9Xm9shP+1iaTZfBHLMPg1PGMxwcY58TYT/7cNHjQkRPR iqiW6PYuV9VRHPuMBD4LPIOk80z69fmaew== X-Received: by 2002:a65:6a4e:0:b0:3aa:38d7:78e8 with SMTP id o14-20020a656a4e000000b003aa38d778e8mr8288058pgu.528.1651978883789; Sat, 07 May 2022 20:01:23 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id o11-20020a056a001bcb00b0050dc76281cesm5772441pfw.168.2022.05.07.20.01.23 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 07 May 2022 20:01:23 -0700 (PDT) Message-Id: In-Reply-To: References: From: ffmpegagent Date: Sun, 08 May 2022 03:01:11 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v3 00/11] libavformat/asf: fix handling of byte array length values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Michael Niedermayer , softworkz Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: jrFL1MkvU4rk The spec allows attachment sizes of up to UINT32_MAX while we can handle only sizes up to INT32_MAX (in downstream code) The debug.assert in get_tag didn't really address this, and truncating the value_len in calling methods cannot be used because the length value is required in order to continue parsing. This adds a check with log message in ff_asf_handle_byte_array to handle those (rare) cases. v2: Rebased & PING v3: Adjustments suggested by Michael softworkz (11): libavformat/asf: fix handling of byte array length values libavformat/asfdec: fix get_value return type and add checks for libavformat/asfdec: fix type of value_len libavformat/asfdec: fixing get_tag libavformat/asfdec: implement parsing of GUID values libavformat/asfdec: remove unused parameters libavformat/asfdec: fix macro definition and use libavformat/asfdec: remove variable redefinition in inner scope libavformat/asfdec: ensure variables are initialized libavformat/asfdec: fix parameter type in asf_read_stream_propertie() libavformat/asfdec: fix variable types and add checks for unsupported values libavformat/asf.c | 8 +- libavformat/asf.h | 2 +- libavformat/asfdec_f.c | 368 ++++++++++++++++++++++++++--------------- 3 files changed, 244 insertions(+), 134 deletions(-) base-commit: f1c19867d72a14699277175101b2bcf1e333af88 Published-As: https://github.com/ffstaging/FFmpeg/releases/tag/pr-ffstaging-12%2Fsoftworkz%2Fmaster-upstream_asf_4-v3 Fetch-It-Via: git fetch https://github.com/ffstaging/FFmpeg pr-ffstaging-12/softworkz/master-upstream_asf_4-v3 Pull-Request: https://github.com/ffstaging/FFmpeg/pull/12 Range-diff vs v2: 1: 0056a93a34 ! 1: b5c56bf5d0 libavformat/asf: fix handling of byte array length values @@ libavformat/asf.c: static int get_id3_tag(AVFormatContext *s, int len) + } + if (!strcmp(name, "WM/Picture")) // handle cover art -- return asf_read_picture(s, val_len); -+ return asf_read_picture(s, (int)val_len); + return asf_read_picture(s, val_len); else if (!strcmp(name, "ID3")) // handle ID3 tag -- return get_id3_tag(s, val_len); -+ return get_id3_tag(s, (int)val_len); + return get_id3_tag(s, val_len); -+ av_log(s, AV_LOG_VERBOSE, "Unsupported byte array in tag %s.\n", name); ++ av_log(s, AV_LOG_DEBUG, "Unsupported byte array in tag %s.\n", name); return 1; } 2: a35b7c87d4 ! 2: e6aa0fb7f3 libavformat/asfdec: fix get_value return type and add checks for @@ libavformat/asfdec_f.c: static int asf_probe(const AVProbeData *pd) { switch (type) { case ASF_BOOL: +@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) + { + AVIOContext *pb = s->pb; + ASFContext *asf = s->priv_data; ++ uint64_t dar_num = 0; ++ uint64_t dar_den = 0; + int desc_count, i, ret; + + desc_count = avio_rl16(pb); @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) /* My sample has that stream set to 0 maybe that mean the container. * ASF stream count starts at 1. I am using 0 to the container value @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, - else if (!strcmp(name, "AspectRatioY")) - asf->dar[0].den = get_value(s->pb, value_type, 32); + if (!strcmp(name, "AspectRatioX")) { -+ const uint64_t value = get_value(s->pb, value_type, 32); -+ if (value > INT32_MAX) { -+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", value); ++ dar_num = get_value(s->pb, value_type, 32); ++ if (dar_num > INT64_MAX) { ++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num); + return AVERROR(ENOTSUP); + } -+ asf->dar[0].num = (int)value; + } + else if (!strcmp(name, "AspectRatioY")) { -+ const uint64_t value = get_value(s->pb, value_type, 32); -+ if (value > INT32_MAX) { -+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", value); ++ dar_den = get_value(s->pb, value_type, 32); ++ if (dar_den > INT64_MAX) { ++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den); + return AVERROR(ENOTSUP); + } -+ asf->dar[0].den = (int)value; + } else get_tag(s, name, value_type, value_len, 32); } + ++ if (dar_num && dar_den) ++ av_reduce(&asf->dar[0].num, &asf->dar[0].den, dar_num, dar_den, INT_MAX); ++ + return 0; + } + +@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size) + { + AVIOContext *pb = s->pb; + ASFContext *asf = s->priv_data; ++ uint64_t dar_num[128] = {0}; ++ uint64_t dar_den[128] = {0}; + int n, stream_num, name_len_utf16, name_len_utf8, value_len; + int ret, i; + n = avio_rl16(pb); @@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size) + av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n", i, stream_num, name_len_utf16, value_type, value_len, name); - if (!strcmp(name, "AspectRatioX")){ +- if (!strcmp(name, "AspectRatioX")){ - int aspect_x = get_value(s->pb, value_type, 16); -+ const uint64_t aspect_x = get_value(s->pb, value_type, 16); -+ if (aspect_x > INT32_MAX) { -+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", aspect_x); -+ return AVERROR(ENOTSUP); -+ } - if(stream_num < 128) +- if(stream_num < 128) - asf->dar[stream_num].num = aspect_x; -+ asf->dar[stream_num].num = (int)aspect_x; - } else if(!strcmp(name, "AspectRatioY")){ +- } else if(!strcmp(name, "AspectRatioY")){ - int aspect_y = get_value(s->pb, value_type, 16); -+ const uint64_t aspect_y = get_value(s->pb, value_type, 16); -+ if (aspect_y > INT32_MAX) { -+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", aspect_y); +- if(stream_num < 128) +- asf->dar[stream_num].den = aspect_y; +- } else { ++ if (!strcmp(name, "AspectRatioX") && stream_num < 128) { ++ dar_num[stream_num] = get_value(s->pb, value_type, 16); ++ if (dar_num[stream_num] > INT64_MAX) { ++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num[stream_num]); + return AVERROR(ENOTSUP); + } - if(stream_num < 128) -- asf->dar[stream_num].den = aspect_y; -+ asf->dar[stream_num].den = (int)aspect_y; - } else { ++ } ++ else if (!strcmp(name, "AspectRatioY") && stream_num < 128) { ++ dar_den[stream_num] = get_value(s->pb, value_type, 16); ++ if (dar_den[stream_num] > INT64_MAX) { ++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den[stream_num]); ++ return AVERROR(ENOTSUP); ++ } ++ } else get_tag(s, name, value_type, value_len, 16); ++ ++ ++ if (stream_num < 128 && dar_num[stream_num] && dar_den[stream_num]) { ++ av_reduce(&asf->dar[stream_num].num, &asf->dar[stream_num].den, dar_num[stream_num], dar_den[stream_num], INT_MAX); ++ dar_num[stream_num] = 0; ++ dar_den[stream_num] = 0; } ++ + av_freep(&name); + } + 3: b8039dc4cf ! 3: b84474d729 libavformat/asfdec: fix type of value_len @@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex len1 = avio_rl16(pb); len2 = avio_rl16(pb); @@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size) - { - AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; + uint64_t dar_num[128] = {0}; + uint64_t dar_den[128] = {0}; - int n, stream_num, name_len_utf16, name_len_utf8, value_len; + int n, name_len_utf8; + uint16_t stream_num, name_len_utf16, value_type; 4: 6e19df6e89 = 4: a54feb51a1 libavformat/asfdec: fixing get_tag 5: 0f3c417efe = 5: e14beb2c15 libavformat/asfdec: implement parsing of GUID values 6: 3bee11e40f = 6: 06062da88b libavformat/asfdec: remove unused parameters 7: ca9bbc79de = 7: 273823a5b4 libavformat/asfdec: fix macro definition and use 8: 238290bbce = 8: aaa37aca21 libavformat/asfdec: remove variable redefinition in inner scope 9: 654e44d526 = 9: 6aedb68b76 libavformat/asfdec: ensure variables are initialized 10: d461f039d2 = 10: 28ebbe7289 libavformat/asfdec: fix parameter type in asf_read_stream_propertie() 11: f606f322bb ! 11: bbeee5f2da libavformat/asfdec: fix variable types and add checks for unsupported values @@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex if (stream_num < 128 && i < FF_ARRAY_ELEMS(asf->streams[stream_num].payload)) { ASFPayload *p = &asf->streams[stream_num].payload[i]; @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s) - { - AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; + uint64_t dar_num = 0; + uint64_t dar_den = 0; - int desc_count, i, ret; + uint16_t desc_count, i; + int ret; @@ libavformat/asfdec_f.c: static int asf_read_language_list(AVFormatContext *s) av_strlcpy(asf->stream_languages[j], lang, sizeof(*asf->stream_languages)); @@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s) - { - AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; + uint64_t dar_num[128] = {0}; + uint64_t dar_den[128] = {0}; - int n, name_len_utf8; - uint16_t stream_num, name_len_utf16, value_type; + int name_len_utf8;