diff mbox series

[FFmpeg-devel] avformat/vividas: Use signed n in read_sb_block()

Message ID 20210215203123.10676-1-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel] avformat/vividas: Use signed n in read_sb_block()
Related show

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Michael Niedermayer Feb. 15, 2021, 8:31 p.m. UTC
Fixes: OOM
Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/vividas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Anton Khirnov Feb. 24, 2021, 2:23 p.m. UTC | #1
Quoting Michael Niedermayer (2021-02-15 21:31:23)
> Fixes: OOM
> Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/vividas.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/vividas.c b/libavformat/vividas.c
> index d745770dc4..b172a48b29 100644
> --- a/libavformat/vividas.c
> +++ b/libavformat/vividas.c
> @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size,
>      uint8_t *buf;
>      uint8_t ibuf[8], sbuf[8];
>      uint32_t k2;
> -    unsigned n;
> +    int n;
>  

Why would that be better, when it's assigned a uint32_t?
Michael Niedermayer Feb. 25, 2021, 8:54 p.m. UTC | #2
On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote:
> Quoting Michael Niedermayer (2021-02-15 21:31:23)
> > Fixes: OOM
> > Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/vividas.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/vividas.c b/libavformat/vividas.c
> > index d745770dc4..b172a48b29 100644
> > --- a/libavformat/vividas.c
> > +++ b/libavformat/vividas.c
> > @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size,
> >      uint8_t *buf;
> >      uint8_t ibuf[8], sbuf[8];
> >      uint32_t k2;
> > -    unsigned n;
> > +    int n;
> >  
> 
> Why would that be better, when it's assigned a uint32_t?

one (maybe not the only one) issue is
if (avio_read(src, buf+8, n) < n) {

avio_read() returns int and has a int size
so this will not work at all with a unsigned int, not only will it not read
more than INT_MAX it also when it fails with an error fail to treat it as 
an error

do you prefer a diferent solution ?

thx

[...]
Andreas Rheinhardt Feb. 25, 2021, 8:59 p.m. UTC | #3
Michael Niedermayer:
> On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote:
>> Quoting Michael Niedermayer (2021-02-15 21:31:23)
>>> Fixes: OOM
>>> Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688
>>>
>>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>>> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>>> ---
>>>  libavformat/vividas.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/libavformat/vividas.c b/libavformat/vividas.c
>>> index d745770dc4..b172a48b29 100644
>>> --- a/libavformat/vividas.c
>>> +++ b/libavformat/vividas.c
>>> @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size,
>>>      uint8_t *buf;
>>>      uint8_t ibuf[8], sbuf[8];
>>>      uint32_t k2;
>>> -    unsigned n;
>>> +    int n;
>>>  
>>
>> Why would that be better, when it's assigned a uint32_t?
> 
> one (maybe not the only one) issue is
> if (avio_read(src, buf+8, n) < n) {
> 
> avio_read() returns int and has a int size
> so this will not work at all with a unsigned int, not only will it not read
> more than INT_MAX it also when it fails with an error fail to treat it as 
> an error
> 
> do you prefer a diferent solution ?
> 
ffio_read_size? Or just use != instead of <? Or check for n > INT_MAX
before the call?

- Andreas
Michael Niedermayer March 28, 2021, 12:15 p.m. UTC | #4
On Thu, Feb 25, 2021 at 09:59:40PM +0100, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote:
> >> Quoting Michael Niedermayer (2021-02-15 21:31:23)
> >>> Fixes: OOM
> >>> Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688
> >>>
> >>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> >>> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> >>> ---
> >>>  libavformat/vividas.c | 2 +-
> >>>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>>
> >>> diff --git a/libavformat/vividas.c b/libavformat/vividas.c
> >>> index d745770dc4..b172a48b29 100644
> >>> --- a/libavformat/vividas.c
> >>> +++ b/libavformat/vividas.c
> >>> @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size,
> >>>      uint8_t *buf;
> >>>      uint8_t ibuf[8], sbuf[8];
> >>>      uint32_t k2;
> >>> -    unsigned n;
> >>> +    int n;
> >>>  
> >>
> >> Why would that be better, when it's assigned a uint32_t?
> > 
> > one (maybe not the only one) issue is
> > if (avio_read(src, buf+8, n) < n) {
> > 
> > avio_read() returns int and has a int size
> > so this will not work at all with a unsigned int, not only will it not read
> > more than INT_MAX it also when it fails with an error fail to treat it as 
> > an error
> > 
> > do you prefer a diferent solution ?
> > 
> ffio_read_size? Or just use != instead of <? Or check for n > INT_MAX
> before the call?

will apply with an != check instead

thx

[...]
diff mbox series

Patch

diff --git a/libavformat/vividas.c b/libavformat/vividas.c
index d745770dc4..b172a48b29 100644
--- a/libavformat/vividas.c
+++ b/libavformat/vividas.c
@@ -235,7 +235,7 @@  static uint8_t *read_sb_block(AVIOContext *src, unsigned *size,
     uint8_t *buf;
     uint8_t ibuf[8], sbuf[8];
     uint32_t k2;
-    unsigned n;
+    int n;
 
     if (avio_read(src, ibuf, 8) < 8)
         return NULL;