From patchwork Thu Dec 13 21:58:40 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: chcunningham@chromium.org X-Patchwork-Id: 11406 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 877F944DD2D for ; Fri, 14 Dec 2018 00:05:26 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id A020E68AA20; Fri, 14 Dec 2018 00:05:26 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pg1-f196.google.com (mail-pg1-f196.google.com [209.85.215.196]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 83FE568AA1E for ; Fri, 14 Dec 2018 00:05:20 +0200 (EET) Received: by mail-pg1-f196.google.com with SMTP id z11so1696616pgu.0 for ; Thu, 13 Dec 2018 14:05:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=8TOlSaGDlbC32BfrAW21McShoytHfggL1ibClszL7mo=; b=Tm6j4wyNj+baajhdmv2bc/p/Y4yhcccgzXwOn0pdfQtb5ru/OQaFbteEeCu3unedQx XGjFURlATBkGvNEOcOo+255i4hwdn5EU6SD6u2MKrGLeL4Qzuex9wXFRXLQvpvFasuKL 5UBP4NzmR5eNEz6u8PCDTuv0Jeg8/WY9Qpya8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=8TOlSaGDlbC32BfrAW21McShoytHfggL1ibClszL7mo=; b=KUT8NvXTq6sPSLySCDp2oWiV6nhtaQL8T7xTR0+B9ApLGSlf5y32PoILNHpe72kAcy CMz0PD3OGgcaLWV1yDw8fh+x4FGLVOZXfLXwn+INIW3GHOBTVsJhF3FkQxxA3RfEh0G8 NehXTIU6lbI8+zIJXsAEZKub/krYt8yrsA6Wdy3+MNqaaGFwUrNyoWRIpjwQ6dgkf+KI DDpklzbcomy/u5Oi4x3E52cC08xhEJIxmQSx8PffnWnH7m2flWvn2srJEeeYEFniYZ9p llVlZFeVaMzy+ZfNeErL/VthdRxN+YL4koFlOHlMLJYx/khMM/iiZmj9a3d6cJTOKOcI VtlA== X-Gm-Message-State: AA+aEWbHeO6FMCnzIiOdtgOEeJgsD96MFHjbWNac/gmYmfpeOHh8RJyV A0G3RFUt64JiH5k7OYy/pxV8S7N89luKNg== X-Google-Smtp-Source: AFSGD/Vnt9M0G8URDmgf0Wu8LzI5pziHsFKcUxRXCiIG+NvrF9RmaCKqzBLSBjCqDBW0/eMahdSgkw== X-Received: by 2002:a62:2c4d:: with SMTP id s74mr471538pfs.6.1544738390844; Thu, 13 Dec 2018 13:59:50 -0800 (PST) Received: from chcunningham-linux.sea.corp.google.com ([2620:15c:38:200:74b:ad27:5acb:a21]) by smtp.gmail.com with ESMTPSA id x3sm9689754pgt.45.2018.12.13.13.59.50 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 13 Dec 2018 13:59:50 -0800 (PST) From: chcunningham To: ffmpeg-devel@ffmpeg.org Date: Thu, 13 Dec 2018 13:58:40 -0800 Message-Id: <20181213215840.214490-1-chcunningham@chromium.org> X-Mailer: git-send-email 2.20.0.rc2.403.gdbc3b29805-goog In-Reply-To: References: MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] lavf/mov: ensure only one tkhd per trak X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Chromium fuzzing produced a whacky file with extra tkhds. This caused an AVStream that was already in use to be corrupted by assigning it a new id, which blows up later in mov_read_trun because the MOVFragmentStreamInfo.index_entry now points OOB. --- libavformat/mov.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index ec57a05803..6f92742e23 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1326,6 +1326,10 @@ static int update_frag_index(MOVContext *c, int64_t offset) return -1; for (i = 0; i < c->fc->nb_streams; i++) { + // Avoid building frag index if streams lack track id. + if (c->fc->streams[i]->id < 0) + return AVERROR_INVALIDDATA; + frag_stream_info[i].id = c->fc->streams[i]->id; frag_stream_info[i].sidx_pts = AV_NOPTS_VALUE; frag_stream_info[i].tfdt_dts = AV_NOPTS_VALUE; @@ -4154,7 +4158,7 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom) st = avformat_new_stream(c->fc, NULL); if (!st) return AVERROR(ENOMEM); - st->id = c->fc->nb_streams; + st->id = -1; sc = av_mallocz(sizeof(MOVStreamContext)); if (!sc) return AVERROR(ENOMEM); @@ -4438,6 +4442,11 @@ static int mov_read_tkhd(MOVContext *c, AVIOContext *pb, MOVAtom atom) st = c->fc->streams[c->fc->nb_streams-1]; sc = st->priv_data; + // Each stream (trak) should have exactly 1 tkhd. This catches bad files and + // avoids corrupting AVStreams mapped to an earlier tkhd. + if (st->id != -1) + return AVERROR_INVALIDDATA; + version = avio_r8(pb); flags = avio_rb24(pb); st->disposition |= (flags & MOV_TKHD_FLAG_ENABLED) ? AV_DISPOSITION_DEFAULT : 0; @@ -4704,6 +4713,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) break; } } + av_assert0(index_entry_pos <= st->nb_index_entries); avio_r8(pb); /* version */ flags = avio_rb24(pb);