diff mbox series

[FFmpeg-devel,17/36] avcodec/hevc_mp4toannexb_bsf: Check NAL size against available input

Message ID 20200530160541.29517-17-andreas.rheinhardt@gmail.com
State Accepted
Commit ea1b71e82f5a1752d59d3bfb9704092a79eba6b5
Headers show
Series [FFmpeg-devel,01/36] avcodec/vp9_superframe_bsf: Check for existence of data before reading it
Related show

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Andreas Rheinhardt May 30, 2020, 4:05 p.m. UTC
The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit
is so big that it extends beyond the end of the input packet; it does so
only implicitly by using the checked version of the bytestream2 API.
But this has downsides compared to real checks: It can lead to huge
allocations (up to 2GiB) even when the input packet is just a few bytes.
And furthermore it leads to uninitialized data being output.
So add a check to error out early if it happens.

Also check directly whether there is enough data for the length field.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
---
 libavcodec/hevc_mp4toannexb_bsf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Comments

Michael Niedermayer May 30, 2020, 6:21 p.m. UTC | #1
On Sat, May 30, 2020 at 06:05:22PM +0200, Andreas Rheinhardt wrote:
> The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit
> is so big that it extends beyond the end of the input packet; it does so
> only implicitly by using the checked version of the bytestream2 API.
> But this has downsides compared to real checks: It can lead to huge
> allocations (up to 2GiB) even when the input packet is just a few bytes.
> And furthermore it leads to uninitialized data being output.
> So add a check to error out early if it happens.
> 
> Also check directly whether there is enough data for the length field.
> 
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
> ---
>  libavcodec/hevc_mp4toannexb_bsf.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)

probably ok

[...]
diff mbox series

Patch

diff --git a/libavcodec/hevc_mp4toannexb_bsf.c b/libavcodec/hevc_mp4toannexb_bsf.c
index a880d9ba9a..ba1deb2848 100644
--- a/libavcodec/hevc_mp4toannexb_bsf.c
+++ b/libavcodec/hevc_mp4toannexb_bsf.c
@@ -142,10 +142,14 @@  static int hevc_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *out)
         int      nalu_type;
         int is_irap, add_extradata, extra_size, prev_size;
 
+        if (bytestream2_get_bytes_left(&gb) < s->length_size) {
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
         for (i = 0; i < s->length_size; i++)
             nalu_size = (nalu_size << 8) | bytestream2_get_byte(&gb);
 
-        if (nalu_size < 2) {
+        if (nalu_size < 2 || nalu_size > bytestream2_get_bytes_left(&gb)) {
             ret = AVERROR_INVALIDDATA;
             goto fail;
         }