From patchwork Thu May 11 00:38:33 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 3646 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.3.129 with SMTP id 123csp463937vsd; Wed, 10 May 2017 17:38:52 -0700 (PDT) X-Received: by 10.223.133.35 with SMTP id 32mr5652259wrh.200.1494463132563; Wed, 10 May 2017 17:38:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1494463132; cv=none; d=google.com; s=arc-20160816; b=MizWYHATLeq8tt4IkCxzi5ReVrJST8CYQSJkHyrSl69ZlM6GzJq/UA614XaXygu8TL ngWdJyvAoxiV0ubOuRky3XtAe/UYPP04MNTr49irqmkXD519OzPq3y/s93mbvyo8+UMF 4rcv5iySllOc+G9xZHPr6x3SXx8XRojPCO2qS6sryRkEDGYoM6Ix6kho+VybWdUbPWEK ++bEBnizGb1eMN1sMry4gQk19ciNITelQlvP7RD/myYVBzObR6wwD4aFo5iJlA37i9sv fMisa4yO7ctVK2MODDdT+oJinYThy3fnDRsFpcXcj+ZQz/tYzLbn/87950fwRRuvwhwS N81Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:message-id:date:to:from:delivered-to :arc-authentication-results; bh=Yh0vTE6PUKPgtjkEu3pcVWQ/Q8iL2eJOehJb0iYoxA0=; b=IrAbzuSCCg2OOU716HRa7GE42G9rkzXqRuouoI0UCkwTlf/KXZrEQVJjPW5qAw1h6l qXEziY1rQBlG+M5NxMYYO4h6dkYgqMmfuYRuSaHshg/vZDxBgDsqB+sOZroXQSGPYYNA jDUs3JacummpHkhQ7CwlUI7df66Rn6/tXxe3QtZmc2F3fI1odoF9XE2dlDDc0wijL+7S vJfAiIEVsFTRnPxVsdwUybl19MLr8DeASFyLo2Ice3a9XjlYitjoa/HIUnzZ58rYorYE XkYZhV1lEzYVAFl5mbSxP1dal7ASK052XdHPXLd+ohPD5FQQgHIk+vbqo/piBOlobkqD vEhQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id i130si181488wme.115.2017.05.10.17.38.52; Wed, 10 May 2017 17:38:52 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 9A1B368973E; Thu, 11 May 2017 03:38:42 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe03-1.mx.upcmail.net (vie01a-dmta-pe03-1.mx.upcmail.net [62.179.121.160]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 0CB156883AE for ; Thu, 11 May 2017 03:38:36 +0300 (EEST) Received: from [172.31.216.43] (helo=vie01a-pemc-psmtp-pe01) by vie01a-dmta-pe03.mx.upcmail.net with esmtp (Exim 4.88) (envelope-from ) id 1d8c7u-0005eC-Eh for ffmpeg-devel@ffmpeg.org; Thu, 11 May 2017 02:38:42 +0200 Received: from localhost ([213.47.41.20]) by vie01a-pemc-psmtp-pe01 with SMTP @ mailcloud.upcmail.net id Joea1v0090S5wYM01oebbU; Thu, 11 May 2017 02:38:35 +0200 X-SourceIP: 213.47.41.20 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Thu, 11 May 2017 02:38:33 +0200 Message-Id: <20170511003833.15087-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.11.0 Subject: [FFmpeg-devel] [PATCH] avcodec/xpmdec: Fix multiple pointer/memory issues X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Most of these were found through code review in response to fixing 1466/clusterfuzz-testcase-minimized-5961584419536896 There is thus no testcase for most of this. The initial issue was Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/xpmdec.c | 37 ++++++++++++++++++++++++++++++------- 1 file changed, 30 insertions(+), 7 deletions(-) diff --git a/libavcodec/xpmdec.c b/libavcodec/xpmdec.c index 9112d4cb5e..03172e4aad 100644 --- a/libavcodec/xpmdec.c +++ b/libavcodec/xpmdec.c @@ -29,6 +29,8 @@ typedef struct XPMContext { uint32_t *pixels; int pixels_size; + uint8_t *buf; + int buf_size; } XPMDecContext; typedef struct ColorEntry { @@ -233,6 +235,8 @@ static uint32_t color_string_to_rgba(const char *p, int len) const ColorEntry *entry; char color_name[100]; + len = FFMIN(FFMAX(len, 0), sizeof(color_name) - 1); + if (*p == '#') { p++; len--; @@ -299,18 +303,25 @@ static int xpm_decode_frame(AVCodecContext *avctx, void *data, { XPMDecContext *x = avctx->priv_data; AVFrame *p=data; - const uint8_t *end, *ptr = avpkt->data; + const uint8_t *end, *ptr; int ncolors, cpp, ret, i, j; int64_t size; uint32_t *dst; avctx->pix_fmt = AV_PIX_FMT_BGRA; - end = avpkt->data + avpkt->size; - while (memcmp(ptr, "/* XPM */", 9) && ptr < end - 9) + av_fast_padded_malloc(&x->buf, &x->buf_size, avpkt->size); + if (!x->buf) + return AVERROR(ENOMEM); + memcpy(x->buf, avpkt->data, avpkt->size); + x->buf[avpkt->size] = 0; + + ptr = x->buf; + end = x->buf + avpkt->size; + while (end - ptr > 9 && memcmp(ptr, "/* XPM */", 9)) ptr++; - if (ptr >= end) { + if (end - ptr <= 9) { av_log(avctx, AV_LOG_ERROR, "missing signature\n"); return AVERROR_INVALIDDATA; } @@ -335,7 +346,7 @@ static int xpm_decode_frame(AVCodecContext *avctx, void *data, size = 1; for (i = 0; i < cpp; i++) - size *= 94; + size *= 95; if (ncolors <= 0 || ncolors > size) { av_log(avctx, AV_LOG_ERROR, "invalid number of colors: %d\n", ncolors); @@ -349,12 +360,15 @@ static int xpm_decode_frame(AVCodecContext *avctx, void *data, return AVERROR(ENOMEM); ptr += mod_strcspn(ptr, ",") + 1; + if (end - ptr < 1) + return AVERROR_INVALIDDATA; + for (i = 0; i < ncolors; i++) { const uint8_t *index; int len; ptr += mod_strcspn(ptr, "\"") + 1; - if (ptr + cpp > end) + if (end - ptr < cpp) return AVERROR_INVALIDDATA; index = ptr; ptr += cpp; @@ -373,14 +387,20 @@ static int xpm_decode_frame(AVCodecContext *avctx, void *data, x->pixels[ret] = color_string_to_rgba(ptr, len); ptr += mod_strcspn(ptr, ",") + 1; + if (end - ptr < 1) + return AVERROR_INVALIDDATA; } for (i = 0; i < avctx->height; i++) { dst = (uint32_t *)(p->data[0] + i * p->linesize[0]); + if (end - ptr < 1) + return AVERROR_INVALIDDATA; ptr += mod_strcspn(ptr, "\"") + 1; + if (end - ptr < 1) + return AVERROR_INVALIDDATA; for (j = 0; j < avctx->width; j++) { - if (ptr + cpp > end) + if (end - ptr < cpp) return AVERROR_INVALIDDATA; if ((ret = ascii2index(ptr, cpp)) < 0) @@ -405,6 +425,9 @@ static av_cold int xpm_decode_close(AVCodecContext *avctx) XPMDecContext *x = avctx->priv_data; av_freep(&x->pixels); + av_freep(&x->buf); + x->buf_size = 0; + return 0; }