diff mbox

[FFmpeg-devel,1/1] libavformat/flacenc: reject too big picture blocks

Message ID 20191030130128.76830-2-mattias.wadman@gmail.com
State New
Headers show

Commit Message

Mattias Wadman Oct. 30, 2019, 1:01 p.m. UTC
A too big picture will case the muxer to write a truncated block size (uint24)
causing the output file to be corrupt.

How to reproduce:

Write a file with truncated block size:
ffmpeg -y -f lavfi -i sine -f lavfi -i color=red:size=2400x2400 -map 0:a:0 -map 1:v:0 -c:v:0 bmp -disposition:1 attached_pic -t 1 test.flac

Try to decode:
ffmpeg -i test.flac test.wav

Signed-off-by: Mattias Wadman <mattias.wadman@gmail.com>
---
 libavformat/flacenc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer Nov. 1, 2019, 6:50 p.m. UTC | #1
On Wed, Oct 30, 2019 at 02:01:28PM +0100, Mattias Wadman wrote:
> A too big picture will case the muxer to write a truncated block size (uint24)
> causing the output file to be corrupt.
> 
> How to reproduce:
> 
> Write a file with truncated block size:
> ffmpeg -y -f lavfi -i sine -f lavfi -i color=red:size=2400x2400 -map 0:a:0 -map 1:v:0 -c:v:0 bmp -disposition:1 attached_pic -t 1 test.flac
> 
> Try to decode:
> ffmpeg -i test.flac test.wav
> 
> Signed-off-by: Mattias Wadman <mattias.wadman@gmail.com>
> ---
>  libavformat/flacenc.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)

will apply

thx

[...]
diff mbox

Patch

diff --git a/libavformat/flacenc.c b/libavformat/flacenc.c
index 93cc79bbe0..7b51c11404 100644
--- a/libavformat/flacenc.c
+++ b/libavformat/flacenc.c
@@ -93,7 +93,7 @@  static int flac_write_picture(struct AVFormatContext *s, AVPacket *pkt)
     AVDictionaryEntry *e;
     const char *mimetype = NULL, *desc = "";
     const AVStream *st = s->streams[pkt->stream_index];
-    int i, mimelen, desclen, type = 0;
+    int i, mimelen, desclen, type = 0, blocklen;
 
     if (!pkt->data)
         return 0;
@@ -140,8 +140,14 @@  static int flac_write_picture(struct AVFormatContext *s, AVPacket *pkt)
         desc = e->value;
     desclen = strlen(desc);
 
+    blocklen = 4 + 4 + mimelen + 4 + desclen + 4 + 4 + 4 + 4 + 4 + pkt->size;
+    if (blocklen >= 1<<24) {
+         av_log(s, AV_LOG_ERROR, "Picture block too big %d >= %d\n", blocklen, 1<<24);
+        return AVERROR(EINVAL);
+    }
+
     avio_w8(pb, 0x06);
-    avio_wb24(pb, 4 + 4 + mimelen + 4 + desclen + 4 + 4 + 4 + 4 + 4 + pkt->size);
+    avio_wb24(pb, blocklen);
 
     avio_wb32(pb, type);