From patchwork Sat May 14 20:55:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Karmani X-Patchwork-Id: 34709 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:a885:b0:7f:4be2:bd17 with SMTP id ca5csp876524pzb; Sat, 14 May 2022 13:55:40 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzxvNyXodp5c95WF0zQ86a1I833+CFYu0gydNHP+MYrHnKvVf0ESpxbfbChmohtYNAC50mC X-Received: by 2002:a17:907:8a20:b0:6f4:bb5d:9e19 with SMTP id sc32-20020a1709078a2000b006f4bb5d9e19mr9360384ejc.190.1652561739842; Sat, 14 May 2022 13:55:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1652561739; cv=none; d=google.com; s=arc-20160816; b=oGsi+IWmxYhpPh6T7ERy7oVa0Hk2VEuCvFXpmfST6JRyFtkrTjjKfcbdH5n7dg4mNC 6YF0679CJMy8dCaBKGWbN9dQdojK557+isCq9fTjO4X4mysUKFn7i8/+hhiOQ/MGRoxZ 1egIbU+FSHSscT9FZjQ7s8DICOHuEKToYNSCIcPhEhZddSrHa7xaMpMVmWvuypfhg6UY bjFbC009VLG/pbERj6flpJTdHZ2Jmu2Ys6H13qPSBt/F/56lYdEzbzC/p9zW/WSB/GGQ WYj11d0EcyMVCzdd3YbRT/Q8tn1Ocvr6dcQmXKJMgIOCHhBRO5RsFHBGweCt1Ek9qt6c Zn2w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:to:mime-version:fcc:date:from:references :in-reply-to:message-id:dkim-signature:delivered-to; bh=P1bZhPB1/k7Po4ElghOcjc4cwu36RhFtHIFsFYyigo8=; b=C4JJgCMtWIkdMNj3NQtAo1LPiaYNo2Lh5Cdz0CGz6emkJZBkS6WbUt3qm3A88M87Zm /hyV1QkEj6hI7h3XmljY2o20FfZGllsZMeuqkDFyGU7mw8/5Zu4MuM/NvKXyD+G7mbE0 91WCCB9WBDeqB6bES/FJ2zmpQ4Ti8TPM+5uCbUtSc1IbO15oNnytoQOEYojsE3rmbPDA UbsnwzAfKUiBbrjFgQz8VYsccZPTyaRjrLbfE2FxUOQVEYzNNPw9gbhZT/KkwhAT18Cf BBqw05OcN6SUvQ415GHBxqtVU0NsGp4mrlitrFAUm736nqNhOiF2baBtEa3kXXD93ABH +1jQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=TlS7qeDG; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id z25-20020a50e699000000b00427ed62bbc8si5599462edm.475.2022.05.14.13.55.38; Sat, 14 May 2022 13:55:39 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=TlS7qeDG; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id F2D5B68B460; Sat, 14 May 2022 23:55:34 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 2AEC968B192 for ; Sat, 14 May 2022 23:55:26 +0300 (EEST) Received: by mail-pj1-f53.google.com with SMTP id ev18so321280pjb.4 for ; Sat, 14 May 2022 13:55:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=+GoWUtc/K8NdATrUbh2gyGZsZqAc5yU+j4p2VkOL2PI=; b=TlS7qeDG3lkVhlfQqDC+yh7FpO4TKpDcKKP4FBrQqKnefPL0J0gOXjUUgqm2WnWlj6 CNKEisPs+icZQCsiFCREMWmD8dMTDk7mbUjRHY+jf5I93VrXMN0/lYS69Iz05tZVNUzC BrE9HzqfHyEf0DUAHdM0dGLOcUu/fYHTT+z+aAqSbSs0he0R3tGCRBP3GyCsB7Wry5tU /8pgTdoDHn/V/8p07wh8pEkoPQVUZZ2R6QuHfRsA5P+7Re1At+swJ3Rj5PN2NRhMHqFE 4rzU5QUOhEJ6YT7cbfB4eY9F4LmXMjKBYhYjgX+J3onjeBf3NFYvzCRnD++rgSMh9iQX cg3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=+GoWUtc/K8NdATrUbh2gyGZsZqAc5yU+j4p2VkOL2PI=; b=zdkHYZBW9yfRIoTWicaubmKrJ7VwIUMM4Yc4dmKOMgxSrlncvIyJto53guZgA8nqaq AhI7mWhUv2xGCalWY8lQK5nEmYyve6OcICxsIKgwCiMbeKpq11S2OOhvAMHyssSUVW1R vM1bLd2+YuUBl2IzDVB6wcOcIvkjuPPMdtsBdvO3ts1gosiZBH9UXyfwJgIElx0Wer3Q 3QmiyFMUX9zhKpFaJE2ZeEqeeysiWqwlEMZmvTW3p7MW/onl5gt7D78ZVXuklK5bdS+L +IOEZbT9GJx5kmKg96x424OWaSYcUChC2+eMnLutbHATlFERPo0ysu1ijPqPY5WLOm5g 4Qew== X-Gm-Message-State: AOAM532L25Tm3CCFF9D2Oid5bb+SHMICunDAnJrvFrUL5DVlHXsBjxnl lAqB+adLlY1rk/3x5+l7mFJLfWybIDEzzQ== X-Received: by 2002:a17:90a:ce13:b0:1d9:acbe:7ede with SMTP id f19-20020a17090ace1300b001d9acbe7edemr22812258pju.16.1652561723999; Sat, 14 May 2022 13:55:23 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id d17-20020a170902aa9100b0015e8d4eb218sm4119363plr.98.2022.05.14.13.55.22 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 14 May 2022 13:55:23 -0700 (PDT) Message-Id: In-Reply-To: References: From: ffmpegagent Date: Sat, 14 May 2022 20:55:12 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v4 00/10] libavformat/asf: fix handling of byte array length values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Michael Niedermayer , softworkz Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: RsdoSt7tbTwK The spec allows attachment sizes of up to UINT32_MAX while we can handle only sizes up to INT32_MAX (in downstream code) The debug.assert in get_tag didn't really address this, and truncating the value_len in calling methods cannot be used because the length value is required in order to continue parsing. This adds a check with log message in ff_asf_handle_byte_array to handle those (rare) cases. v2: Rebased & PING v3: Adjustments suggested by Michael v4: 1 of 11 merged, 10 to go.. softworkz (10): libavformat/asf: fix handling of byte array length values libavformat/asfdec: fix get_value return type and add checks for libavformat/asfdec: fix type of value_len libavformat/asfdec: fixing get_tag libavformat/asfdec: implement parsing of GUID values libavformat/asfdec: fix macro definition and use libavformat/asfdec: remove variable redefinition in inner scope libavformat/asfdec: ensure variables are initialized libavformat/asfdec: fix parameter type in asf_read_stream_propertie() libavformat/asfdec: fix variable types and add checks for unsupported values libavformat/asf.c | 8 +- libavformat/asf.h | 2 +- libavformat/asfdec_f.c | 338 +++++++++++++++++++++++++++-------------- 3 files changed, 229 insertions(+), 119 deletions(-) base-commit: e6f0cec88041449475f37b82b76699d2f7b5b124 Published-As: https://github.com/ffstaging/FFmpeg/releases/tag/pr-ffstaging-12%2Fsoftworkz%2Fmaster-upstream_asf_4-v4 Fetch-It-Via: git fetch https://github.com/ffstaging/FFmpeg pr-ffstaging-12/softworkz/master-upstream_asf_4-v4 Pull-Request: https://github.com/ffstaging/FFmpeg/pull/12 Range-diff vs v3: 1: b5c56bf5d0 = 1: 60966b7907 libavformat/asf: fix handling of byte array length values 2: e6aa0fb7f3 ! 2: 5acab7b52b libavformat/asfdec: fix get_value return type and add checks for @@ libavformat/asfdec_f.c: static int asf_probe(const AVProbeData *pd) { switch (type) { case ASF_BOOL: -@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int desc_count, i, ret; desc_count = avio_rl16(pb); -@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s) /* My sample has that stream set to 0 maybe that mean the container. * ASF stream count starts at 1. I am using 0 to the container value * since it's unused. */ @@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, return 0; } -@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; @@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t int n, stream_num, name_len_utf16, name_len_utf8, value_len; int ret, i; n = avio_rl16(pb); -@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s) av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n", i, stream_num, name_len_utf16, value_type, value_len, name); 3: b84474d729 ! 3: 97e0d765c9 libavformat/asfdec: fix type of value_len @@ libavformat/asfdec_f.c: static uint64_t get_value(AVIOContext *pb, int type, int { ASFContext *asf = s->priv_data; char *value = NULL; -@@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContext *s, int64_t size) - static int asf_read_content_desc(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContext *s) + static int asf_read_content_desc(AVFormatContext *s) { AVIOContext *pb = s->pb; - int len1, len2, len3, len4, len5; @@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex len1 = avio_rl16(pb); len2 = avio_rl16(pb); -@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size) +@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s) ASFContext *asf = s->priv_data; uint64_t dar_num[128] = {0}; uint64_t dar_den[128] = {0}; 4: a54feb51a1 = 4: 025123f72d libavformat/asfdec: fixing get_tag 5: e14beb2c15 = 5: 2d01e4dff5 libavformat/asfdec: implement parsing of GUID values 6: 06062da88b < -: ---------- libavformat/asfdec: remove unused parameters 7: 273823a5b4 = 6: 33b3d163df libavformat/asfdec: fix macro definition and use 8: aaa37aca21 = 7: 1509b83f47 libavformat/asfdec: remove variable redefinition in inner scope 9: 6aedb68b76 = 8: fd31b0be2e libavformat/asfdec: ensure variables are initialized 10: 28ebbe7289 = 9: f8728b1c51 libavformat/asfdec: fix parameter type in asf_read_stream_propertie() 11: bbeee5f2da = 10: 78ed5aeb38 libavformat/asfdec: fix variable types and add checks for unsupported values