diff mbox series

[FFmpeg-devel,1/1] avformat: mca: relax a condition check to be able to play certain files

Message ID 20201002055336.38476-2-liushuyu@aosc.io
State New
Headers show
Series avformat: mca: relax a condition check to be able to play
Related show

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

liushuyu@aosc.io Oct. 2, 2020, 5:53 a.m. UTC
From: liushuyu <liushuyu@aosc.io>

In certain mca files, the coefficient table is in the data section
instead of the header section. In this case, the coefficient offset
relative to the header ending marker is a negative value thus failing
the original condition check at line 146.

The new check just check if the coefficient offset is within the file
range (since there is no way to know where the actual audio samples are
without the correct header information).
---
 libavformat/mca.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Comments

Paul B Mahol Oct. 2, 2020, 8:14 a.m. UTC | #1
On Thu, Oct 01, 2020 at 11:53:36PM -0600, liushuyu@aosc.io wrote:
> From: liushuyu <liushuyu@aosc.io>
> 
> In certain mca files, the coefficient table is in the data section
> instead of the header section. In this case, the coefficient offset
> relative to the header ending marker is a negative value thus failing
> the original condition check at line 146.
> 
> The new check just check if the coefficient offset is within the file
> range (since there is no way to know where the actual audio samples are
> without the correct header information).
> ---
>  libavformat/mca.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 

LGTM, remind me to apply this if I forgot.
liushuyu@aosc.io Oct. 29, 2020, 5:44 a.m. UTC | #2
On 2020-10-02 02:14, Paul B Mahol wrote:
> On Thu, Oct 01, 2020 at 11:53:36PM -0600, liushuyu@aosc.io wrote:
>> From: liushuyu <liushuyu@aosc.io>
>> 
>> In certain mca files, the coefficient table is in the data section
>> instead of the header section. In this case, the coefficient offset
>> relative to the header ending marker is a negative value thus failing
>> the original condition check at line 146.
>> 
>> The new check just check if the coefficient offset is within the file
>> range (since there is no way to know where the actual audio samples 
>> are
>> without the correct header information).
>> ---
>>  libavformat/mca.c | 10 +++++-----
>>  1 file changed, 5 insertions(+), 5 deletions(-)
>> 
> 
> LGTM, remind me to apply this if I forgot.
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Hi there,

I am very sorry but are there any more issues that prevent this patch 
from being applied?

Thanks,
Zixing
diff mbox series

Patch

diff --git a/libavformat/mca.c b/libavformat/mca.c
index 27cfb1c..5bb9a35 100644
--- a/libavformat/mca.c
+++ b/libavformat/mca.c
@@ -48,9 +48,9 @@  static int read_header(AVFormatContext *s)
     int64_t file_size = avio_size(s->pb);
     uint16_t version = 0;
     uint32_t header_size, data_size, data_offset, loop_start, loop_end,
-        nb_samples, nb_metadata, coef_offset = 0;
+        nb_samples, nb_metadata = 0;
     int ch, ret;
-    int64_t ret_size;
+    int64_t ret_size, coef_offset = 0;
 
     st = avformat_new_stream(s, NULL);
     if (!st)
@@ -144,10 +144,10 @@  static int read_header(AVFormatContext *s)
     }
 
     // coefficient alignment = 0x30; metadata size = 0x14
-    if (0x30 * par->channels + nb_metadata * 0x14 > header_size)
-        return AVERROR_INVALIDDATA;
     coef_offset =
-        header_size - 0x30 * par->channels + nb_metadata * 0x14;
+        (int64_t)header_size - 0x30 * par->channels + nb_metadata * 0x14;
+    if (coef_offset < 0 || coef_offset >= file_size)
+        return AVERROR_INVALIDDATA;
 
     st->start_time = 0;
     par->codec_id = AV_CODEC_ID_ADPCM_THP_LE;