From patchwork Fri Nov 29 19:44:09 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 16488 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id EFE53449BF4 for ; Fri, 29 Nov 2019 21:44:24 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id C543568B3FD; Fri, 29 Nov 2019 21:44:24 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm1-f65.google.com (mail-wm1-f65.google.com [209.85.128.65]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 5EE7B68B1E0 for ; Fri, 29 Nov 2019 21:44:18 +0200 (EET) Received: by mail-wm1-f65.google.com with SMTP id g206so15274325wme.1 for ; Fri, 29 Nov 2019 11:44:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=5k1xzEFjKsGvYsebPNGOiVYqkGy6OsI0nTziLqiRkHI=; b=RxAceYbr9kGMAWOLHeo4eSI73XzU2eUO1ChGitX1sce1ROp7kUUZqRRJh/Buykdpfv BN5s7/U2ASCoAr5fk16h8FE7F0RVg215+MuVZ0LVPgPdE/HUcVZLSaVOaNB7xUkzheTR u96L0LbWSQbCOuAeq4iNb+0A3kTmo9AUxw0U8ZGa6FIUoq/cnqEyt72bhGWdk483in0d knh7DgWQz3qiPVYn7gPxTKB6za8znxpgwerisyz9OUeMOgZBsXdggGHi2znPLa4WmTZY pYWNz5ZzbDC2ZxAyoaU/Fj/c34MC15+8myb/tJyp/e/ZrDjVusLXuBSVM17QnN4Xzjjj iqqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=5k1xzEFjKsGvYsebPNGOiVYqkGy6OsI0nTziLqiRkHI=; b=XBK0A/aR6inZuyNJSCH1R1KYsgsn+BFwtNptgWxu7VWUIA6iFkLXae7jEZwyU9mDav SiDJEsw4HpdUycflHEMngNvla8uvHqJstwHJ3vWwCyoe2yQ5/S6ao/MmeE208eGaVYEY Xam6da/X9oNPwSGmaBL9tgObJNzcfTg6vb+rLjvINbDMMwsPGu4q6gLmunxv9QbK3e+m YPz8VLtHSBE3NJDcx1WrWegO80+XoW5P+kbqJ3PuKP2yGdJl8gafthQSaLESca11NasS BwE/eOE6yb9D00KF2hFaCB9SJMkQUjnmRPSiui10MyBq7WNHF+ziij0SNvMX4YkSzT/l +hMg== X-Gm-Message-State: APjAAAXPx6KRAUFr+TGfovbugxaFmWJC9VjijnMxlfn09DJ9ZNVuFTLw 5qoAbpd/vNdPLi77rs+WSxdRj5GH X-Google-Smtp-Source: APXvYqzXU2DIAUzQS0UqlnOdnPtdUtIJY4ebecn8R9qNLnhw50jMEmuziOXWvh7ve2wrVfTy9JRvCQ== X-Received: by 2002:a1c:23ca:: with SMTP id j193mr15707211wmj.83.1575056657640; Fri, 29 Nov 2019 11:44:17 -0800 (PST) Received: from sblaptop.fritz.box (ipbcc08e23.dynamic.kabel-deutschland.de. [188.192.142.35]) by smtp.gmail.com with ESMTPSA id x7sm28059531wrq.41.2019.11.29.11.44.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 Nov 2019 11:44:17 -0800 (PST) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Fri, 29 Nov 2019 20:44:09 +0100 Message-Id: <20191129194411.20168-1-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 1/3] avformat/flac_picture: Simplify checks X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" During parsing a flac picture metadata block, the mimetype is read as follows: Its 32b size field is read and checked for being in the range 1..63; afterwards, the actual mimetype-string is read into a buffer of size 64, where the length to read is the minimum of the length field and the size of the destination buffer -1. Then an assert guards that length is indeed < the size of the destination buffer before the string in the buffer is zero-terminated. The FFMIN as well as the assert are actually redundant, as it has been checked that the string (even after terminating) fits into the buffer. In order to make this clear, reword the check "len >= 64" to "len >= sizeof(mimetype)" and drop the FFMIN as well as the assert. Signed-off-by: Andreas Rheinhardt --- libavformat/flac_picture.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/libavformat/flac_picture.c b/libavformat/flac_picture.c index f0871d9c79..6463a370c8 100644 --- a/libavformat/flac_picture.c +++ b/libavformat/flac_picture.c @@ -19,7 +19,6 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ -#include "libavutil/avassert.h" #include "libavutil/intreadwrite.h" #include "libavcodec/png.h" #include "avformat.h" @@ -54,15 +53,14 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size) /* picture mimetype */ len = avio_rb32(pb); - if (len <= 0 || len >= 64 || - avio_read(pb, mimetype, FFMIN(len, sizeof(mimetype) - 1)) != len) { + if (len <= 0 || len >= sizeof(mimetype) || + avio_read(pb, mimetype, len) != len) { av_log(s, AV_LOG_ERROR, "Could not read mimetype from an attached " "picture.\n"); if (s->error_recognition & AV_EF_EXPLODE) ret = AVERROR_INVALIDDATA; goto fail; } - av_assert0(len < sizeof(mimetype)); mimetype[len] = 0; while (mime->id != AV_CODEC_ID_NONE) {