From patchwork Tue Jul 21 02:12:10 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 21209 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 74DF844B6A8 for ; Tue, 21 Jul 2020 05:12:41 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 4EF4F68BAE7; Tue, 21 Jul 2020 05:12:41 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-ej1-f66.google.com (mail-ej1-f66.google.com [209.85.218.66]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E7D0468B834 for ; Tue, 21 Jul 2020 05:12:34 +0300 (EEST) Received: by mail-ej1-f66.google.com with SMTP id a1so20035976ejg.12 for ; Mon, 20 Jul 2020 19:12:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=61JTjLHjl0Z8LBjnChnlH4xVLtrXfcP4gbKLqLOrzJ4=; b=DbFf/u1LZ7BRlj1R4cs1vK9jvRZl/5dAuCgJBkkwnSIWkeY0RY9ShOVLvhmf70aXQW 88/vMEGEePJPuqLuLJKy9vIWjAV2AGzwsbN5lMm3LL1h0JnqZG1V+MIhRej/0+XvuZuf k0qVFuNQhViT73bva2c/jIggYoYV2z32Jsi+E29Z4MWJ76wBYay4Q3lUpV3JuuIlz84w qk8pFN29bZttRWovgZu005fXFAiAO4Gk2wGXsbrjoDo6L0gnQNsJ73hF2iuWloaxgfWV Iae0HGpNpNTsw/RgWvwTVPvQ4hVgr81uq4KCiSnw4NQ/Ljv0OEtscUu4wa5yrywVvB2x UNzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=61JTjLHjl0Z8LBjnChnlH4xVLtrXfcP4gbKLqLOrzJ4=; b=dNZyPVTlvRY+CsxfbGvqXIyENXfHz6wpJw7YvZFvhYTcxDdkxFlIeSkIoBNuHFELf0 0xp/4POzakl/WA1gdWJahBlD9lHhhs3uOh+lRWE/MucJo7MTlEYauv0OjQVsdebsa+dY zGvqOsziX8uAFBkFv6hbNqAC0Nl6IDOscHs99yyDca+emfDoWkQVbuPtv/0rszHtDupr Bk+lnplJ3srS9O1DuhVriWsicRZtkT7OqpQOuZ8UHGxkYkn4ZXuYK+AwbdTZk5WFTC2u n4SaC+GI7+Z4DPSMpnIXLd9VVODbqqobNtxlOA/PEv47I+D4fskq7DHpa7tVS5BJ38KC 6/IA== X-Gm-Message-State: AOAM531I7PdfhAJKqSsy/PdviOSD+UTG9XXg7IG90BnH7HgTYeBqFsFC WHtJVEO2ZXBUugjV4MGVN9KIDFBB X-Google-Smtp-Source: ABdhPJxtX2dM6NuWn3I2YgriqlHnBSp7Q0EhRjUCxqQBwyHC1zExBxc+qoT+SBbA5pCHBP4BH7BOpg== X-Received: by 2002:a17:907:2489:: with SMTP id zg9mr22881609ejb.48.1595297554000; Mon, 20 Jul 2020 19:12:34 -0700 (PDT) Received: from sblaptop.fritz.box (ipbcc10296.dynamic.kabel-deutschland.de. [188.193.2.150]) by smtp.gmail.com with ESMTPSA id p9sm15528563ejd.50.2020.07.20.19.12.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2020 19:12:33 -0700 (PDT) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Tue, 21 Jul 2020 04:12:10 +0200 Message-Id: <20200721021215.32647-2-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200719204755.32269-1-andreas.rheinhardt@gmail.com> References: <20200719204755.32269-1-andreas.rheinhardt@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 4/9] avformat/rmdec: Actually return value < 0 on read_header failure X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" The RealMedia demuxer's read_header function initially initializes ret, the variable designated for the return variable to -1. Afterwards, chunks of the file are parsed in a loop until an error happens or until the actual frame data is encountered. If the first function whose return value is put into ret doesn't fail, then ret contains a value >= 0 (actually == 0) and this is what will be returned if an error is encountered afterwards. This is a regression since 35bbc1955a58ba74552c50d9161084644f00bbd3. Before that, ret had never been overwritten with a nonnegative value. Signed-off-by: Andreas Rheinhardt --- libavformat/rmdec.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index a36e693ab2..6851b7e1f4 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -538,7 +538,7 @@ static int rm_read_header(AVFormatContext *s) unsigned int data_off = 0, indx_off = 0; char buf[128], mime[128]; int flags = 0; - int ret = -1; + int ret; unsigned size, v; int64_t codec_pos; @@ -554,6 +554,7 @@ static int rm_read_header(AVFormatContext *s) avio_skip(pb, tag_size - 8); for(;;) { + ret = AVERROR_INVALIDDATA; if (avio_feof(pb)) goto fail; tag = avio_rl32(pb); @@ -619,8 +620,9 @@ static int rm_read_header(AVFormatContext *s) avio_seek(pb, codec_pos + size, SEEK_SET); } else { avio_skip(pb, -4); - if (ff_rm_read_mdpr_codecdata(s, s->pb, st, st->priv_data, - size, mime) < 0) + ret = ff_rm_read_mdpr_codecdata(s, s->pb, st, st->priv_data, + size, mime); + if (ret < 0) goto fail; }