From patchwork Thu Aug 24 23:15:31 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 4827 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.2.15.201 with SMTP id 70csp29114jao; Thu, 24 Aug 2017 16:16:36 -0700 (PDT) X-Received: by 10.28.152.14 with SMTP id a14mr172476wme.35.1503616596192; Thu, 24 Aug 2017 16:16:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1503616596; cv=none; d=google.com; s=arc-20160816; b=cVcglTBomvpV2U1KY4qTNgt8YIHXk3cWIM+0bFRCqkDeQvDWK1ij3wIRjPsQCT9Wg3 8gMviaNQBZ469JOtKtx/BqsBGaBxyVxq5c5HDGRgSoMY2pXMyZmU/fSoV0r4g95ECdGb ydghS3nLQqvsThvXfVLTkrokQPQ+Lu5SH/KO6bg8KoAfGXjQGCwedkrH+QSoFFXxzv+C 01mi+Eh8O6S3dlJXoaofVksfo0looTFGIP11TKjvWY3r27LC9NuhSGMODtT3u6jyo6gt h+6Zjq47ScS5pzVcqW8uxitHkojbmIamssqnBz8HzGdBS0je9HosfIAIqPs07sVx+4Hn +1Gg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:mime-version:references:in-reply-to :message-id:date:to:from:delivered-to:arc-authentication-results; bh=PQiSMdioTS9iIdguIY1HutwmN5lw98lozAk57K8fth4=; b=oGT1Eq4RLkT4zG6lZeU69Lt4x1NwHwHAdP+S4SLp94lFw3LxQxAgyeF3oYUE47+bmT 35AHL91NFJMG3o1v7PKAoPT3tTHWG0MgPszyqGYlDn+woTmEyT6HN2LpLV887FA5uEcI vq9c9so2U1wJ7KpgzoMpMrGJm4n4/efY2lKS0cU9W06jxR/fsChWTIwqTtQFTX0puXU5 YbXwQMBB9J40zQaYauNEUc4l4XbmE35awe6HmF6gAQ0eBnqPdkAQ49BkoXrSCiB3kFXQ JiHy/ESBW3g97Jq8Zkdy2dUF2lNQrbmqEjW+AVCqtR5EhRlXzAfb9klUvTDdpSm/QOUf xdFQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id b193si120101wme.227.2017.08.24.16.16.34; Thu, 24 Aug 2017 16:16:36 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id C82F56899F8; Fri, 25 Aug 2017 02:15:43 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-1.mx.upcmail.net (vie01a-dmta-pe05-1.mx.upcmail.net [84.116.36.11]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C7171689215 for ; Fri, 25 Aug 2017 02:15:36 +0300 (EEST) Received: from [172.31.216.43] (helo=vie01a-pemc-psmtp-pe01) by vie01a-dmta-pe05.mx.upcmail.net with esmtp (Exim 4.88) (envelope-from ) id 1dl1Ll-0004Pi-1t for ffmpeg-devel@ffmpeg.org; Fri, 25 Aug 2017 01:15:45 +0200 Received: from localhost ([213.47.41.20]) by vie01a-pemc-psmtp-pe01 with SMTP @ mailcloud.upcmail.net id 1BFd1w01g0S5wYM01BFedr; Fri, 25 Aug 2017 01:15:39 +0200 X-SourceIP: 213.47.41.20 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Fri, 25 Aug 2017 01:15:31 +0200 Message-Id: <20170824231532.16002-5-michael@niedermayer.cc> X-Mailer: git-send-email 2.14.1 In-Reply-To: <20170824231532.16002-1-michael@niedermayer.cc> References: <20170824231532.16002-1-michael@niedermayer.cc> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 5/6] avformat/asfdec: Fix DoS due to lack of eof check X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: =?UTF-8?q?=E5=AD=99=E6=B5=A9=20and=20=E5=BC=A0=E6=B4=AA=E4=BA=AE=28?= =?UTF-8?q?=E6=9C=9B=E5=88=9D=29?= Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" From: 孙浩 and 张洪亮(望初) Fixes: loop.asf Found-by: Xiaohei and Wangchu from Alibaba Security Team Signed-off-by: Michael Niedermayer --- libavformat/asfdec_f.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index be09a92bd1..00dd5ec41d 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -749,13 +749,20 @@ static int asf_read_marker(AVFormatContext *s, int64_t size) count = avio_rl32(pb); // markers count avio_rl16(pb); // reserved 2 bytes name_len = avio_rl16(pb); // name length - for (i = 0; i < name_len; i++) + for (i = 0; i < name_len; i++) { + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; avio_r8(pb); // skip the name + } + for (i = 0; i < count; i++) { int64_t pres_time; int name_len; + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; + avio_rl64(pb); // offset, 8 bytes pres_time = avio_rl64(pb); // presentation time pres_time -= asf->hdr.preroll * 10000;