From patchwork Thu Aug 24 23:15:27 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 4825 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.2.15.201 with SMTP id 70csp28894jao; Thu, 24 Aug 2017 16:15:56 -0700 (PDT) X-Received: by 10.28.228.135 with SMTP id b129mr207276wmh.120.1503616556884; Thu, 24 Aug 2017 16:15:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1503616556; cv=none; d=google.com; s=arc-20160816; b=lGUQ1RuDpFNGOxG6gBLYHxxenfnvdsDBEq3ps0aks8wf0hyAvWdomHFulRzMbJU9qw Eyysg0aAt9kfk3AEIbWbRJT0OjcOSehpRpne3l7UvNyz+Endx0sNNHoBrHCqs9F3tCTc 1ZeCihytTLnRGr8O80UVzwUoYjTEP+Js2ejmAiuptL7zdVFYCdziwj9xrnBSx5TD5BaX /g6N/EJorfW50iPakhhIXYH1OALCovQesFnRO2ZLeWgJCe1LwOMLHiA/LTBTpJ8lUKHq C2AywxAxgOtJMEL9QfeN+5OSbD9ftQ1mK3B4BHmGtrjVqJI0s+EFakvb7U9PxT6GySus NbKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:mime-version:message-id:date:to:from :delivered-to:arc-authentication-results; bh=e3zZXZBB1fFa9c8omGcgbx1mRSqd8ydZDSOACqy0/SY=; b=uyz/Vis4CnRIVxtshJJqzMZN3sRe27x8kw/rOk/F+oP2VPMO6TxBSJGn5R99CkujET ZcqI0EIy5LqX2DHud+WheCk7asTBRBMgTkZMGHX7SrkKYFycefW3L7rkG5EEciGUL8al 5IcH3IsyFwnZptuvsH/ZswcvXyDdYBD+r7ZuiTOYHMPXZJebWd6/xHZml4eHPAtowjBx g0E2zTEOSBt/9V9YvSaoyM9OliVqQNHU4PwqySYqt8sovKHlgfV1+BU4NzL+lqYAkf51 xyzvzYHjn3BdYm1XUDs5HU+NZkKg0EXf7bX/18HswnNGZ5cUPpvnAO/Ehc7JrmFjpmoK LdiA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id n17si4330337wrn.230.2017.08.24.16.15.56; Thu, 24 Aug 2017 16:15:56 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 2C12E6891FA; Fri, 25 Aug 2017 02:15:40 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-1.mx.upcmail.net (vie01a-dmta-pe07-1.mx.upcmail.net [84.116.36.17]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C2F2768826E for ; Fri, 25 Aug 2017 02:15:33 +0300 (EEST) Received: from [172.31.216.43] (helo=vie01a-pemc-psmtp-pe01) by vie01a-dmta-pe07.mx.upcmail.net with esmtp (Exim 4.88) (envelope-from ) id 1dl1Lh-0008FY-LB for ffmpeg-devel@ffmpeg.org; Fri, 25 Aug 2017 01:15:41 +0200 Received: from localhost ([213.47.41.20]) by vie01a-pemc-psmtp-pe01 with SMTP @ mailcloud.upcmail.net id 1BFY1w01W0S5wYM01BFZbz; Fri, 25 Aug 2017 01:15:34 +0200 X-SourceIP: 213.47.41.20 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Fri, 25 Aug 2017 01:15:27 +0200 Message-Id: <20170824231532.16002-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.14.1 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 1/6] avformat/cinedec: Fix DoS due to lack of eof check X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: =?UTF-8?q?=E5=AD=99=E6=B5=A9=20and=20=E5=BC=A0=E6=B4=AA=E4=BA=AE=28?= =?UTF-8?q?=E6=9C=9B=E5=88=9D=29?= Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" From: 孙浩 and 张洪亮(望初) Fixes: loop.cine Found-by: Xiaohei and Wangchu from Alibaba Security Team Signed-off-by: Michael Niedermayer --- libavformat/cinedec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/cinedec.c b/libavformat/cinedec.c index 763b93ba2e..de34fb9638 100644 --- a/libavformat/cinedec.c +++ b/libavformat/cinedec.c @@ -267,8 +267,12 @@ static int cine_read_header(AVFormatContext *avctx) /* parse image offsets */ avio_seek(pb, offImageOffsets, SEEK_SET); - for (i = 0; i < st->duration; i++) + for (i = 0; i < st->duration; i++) { + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; + av_add_index_entry(st, avio_rl64(pb), i, 0, 0, AVINDEX_KEYFRAME); + } return 0; }