| Message ID | 20200530160541.29517-17-andreas.rheinhardt@gmail.com |
|---|---|
| State | Accepted |
| Commit | ea1b71e82f5a1752d59d3bfb9704092a79eba6b5 |
| Headers | show |
| Series | [FFmpeg-devel,01/36] avcodec/vp9_superframe_bsf: Check for existence of data before reading it | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
On Sat, May 30, 2020 at 06:05:22PM +0200, Andreas Rheinhardt wrote: > The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit > is so big that it extends beyond the end of the input packet; it does so > only implicitly by using the checked version of the bytestream2 API. > But this has downsides compared to real checks: It can lead to huge > allocations (up to 2GiB) even when the input packet is just a few bytes. > And furthermore it leads to uninitialized data being output. > So add a check to error out early if it happens. > > Also check directly whether there is enough data for the length field. > > Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> > --- > libavcodec/hevc_mp4toannexb_bsf.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) probably ok [...]
diff --git a/libavcodec/hevc_mp4toannexb_bsf.c b/libavcodec/hevc_mp4toannexb_bsf.c index a880d9ba9a..ba1deb2848 100644 --- a/libavcodec/hevc_mp4toannexb_bsf.c +++ b/libavcodec/hevc_mp4toannexb_bsf.c @@ -142,10 +142,14 @@ static int hevc_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *out) int nalu_type; int is_irap, add_extradata, extra_size, prev_size; + if (bytestream2_get_bytes_left(&gb) < s->length_size) { + ret = AVERROR_INVALIDDATA; + goto fail; + } for (i = 0; i < s->length_size; i++) nalu_size = (nalu_size << 8) | bytestream2_get_byte(&gb); - if (nalu_size < 2) { + if (nalu_size < 2 || nalu_size > bytestream2_get_bytes_left(&gb)) { ret = AVERROR_INVALIDDATA; goto fail; }
The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit is so big that it extends beyond the end of the input packet; it does so only implicitly by using the checked version of the bytestream2 API. But this has downsides compared to real checks: It can lead to huge allocations (up to 2GiB) even when the input packet is just a few bytes. And furthermore it leads to uninitialized data being output. So add a check to error out early if it happens. Also check directly whether there is enough data for the length field. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> --- libavcodec/hevc_mp4toannexb_bsf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)