diff mbox series

[FFmpeg-devel,1/5] avcodec/evc_frame_merge: ensure the assembled buffer fits in an AVPacket

Message ID 20230622192918.3638-1-jamrial@gmail.com
State Accepted
Commit b1b45ac9d445752e7cb0e10b2b9ee9aa4023e3a0
Headers show
Series [FFmpeg-devel,1/5] avcodec/evc_frame_merge: ensure the assembled buffer fits in an AVPacket | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

James Almer June 22, 2023, 7:29 p.m. UTC
Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/evc_frame_merge_bsf.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

Comments

James Almer June 23, 2023, 11:43 a.m. UTC | #1
On 6/22/2023 4:29 PM, James Almer wrote:
> Signed-off-by: James Almer <jamrial@gmail.com>
> ---
>   libavcodec/evc_frame_merge_bsf.c | 12 ++++++++++--
>   1 file changed, 10 insertions(+), 2 deletions(-)

Will apply set.
Dawid Kozinski June 27, 2023, 10:06 a.m. UTC | #2
Hi James,
I would like to thank you for the thorough review and merging of the
majority of the 10-patchset into the FFmpeg master branch. Your personal
dedication to making numerous valuable and impactful improvements to the
code has been remarkable. 
I am really grateful for your work and your time devoted to merging the EVC
implementation into FFmpeg master branch.

While the progress made so far has been significant, there are still two
remaining patches. I mean the implementation of wrappers for the EVC encoder
and decoder. I wanted to inquire about merging these two patches into the
master branch. We are looking forward to seeing the complete integration of
these essential components. 
Furthermore, I wanted to ask if there is anything we can do to facilitate
the integration of our patchset with the FFmpeg project. 
Whether it involves providing additional changes, conducting further
testing, or assisting in the code review process, we are more than willing
to collaborate and contribute in any way we can. Let us know what we can do
to enhance the overall integration process.

Once again, I would like to express my deep appreciation for your invaluable
contributions, thorough review, and the multitude of changes you have made
to the code. 

Thank you for your time, contribution, and consideration. I look forward to
your response.

Kind regards
Dawid

> -----Original Message-----
> From: ffmpeg-devel <ffmpeg-devel-bounces@ffmpeg.org> On Behalf Of James
> Almer
> Sent: piątek, 23 czerwca 2023 13:43
> To: ffmpeg-devel@ffmpeg.org
> Subject: Re: [FFmpeg-devel] [PATCH 1/5] avcodec/evc_frame_merge: ensure
> the assembled buffer fits in an AVPacket
> 
> On 6/22/2023 4:29 PM, James Almer wrote:
> > Signed-off-by: James Almer <jamrial@gmail.com>
> > ---
> >   libavcodec/evc_frame_merge_bsf.c | 12 ++++++++++--
> >   1 file changed, 10 insertions(+), 2 deletions(-)
> 
> Will apply set.
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://protect2.fireeye.com/v1/url?k=322c563f-53a74374-322ddd70-
> 74fe485fb305-d0a347f67d0a53df&q=1&e=5018ca25-0c81-4d7a-8598-
> 9876a225f78c&u=https%3A%2F%2Fffmpeg.org%2Fmailman%2Flistinfo%2Fffmp
> eg-devel
> 
> To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org
> with subject "unsubscribe".
diff mbox series

Patch

diff --git a/libavcodec/evc_frame_merge_bsf.c b/libavcodec/evc_frame_merge_bsf.c
index 121f93c0b0..3e1258c6c9 100644
--- a/libavcodec/evc_frame_merge_bsf.c
+++ b/libavcodec/evc_frame_merge_bsf.c
@@ -199,8 +199,16 @@  static int evc_frame_merge_filter(AVBSFContext *bsf, AVPacket *out)
         au_end_found = err;
 
         nalu_size += EVC_NALU_LENGTH_PREFIX_SIZE;
+
+        data_size = ctx->au_buffer.data_size + nalu_size;
+        if (data_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
+            av_log(bsf, AV_LOG_ERROR, "Assembled packet is too big\n");
+            err = AVERROR(ERANGE);
+            goto end;
+        }
+
         buffer = av_fast_realloc(ctx->au_buffer.data, &ctx->au_buffer.capacity,
-                                 ctx->au_buffer.data_size + nalu_size);
+                                 data_size);
         if (!buffer) {
             av_freep(&ctx->au_buffer.data);
             err = AVERROR_INVALIDDATA;
@@ -210,7 +218,7 @@  static int evc_frame_merge_filter(AVBSFContext *bsf, AVPacket *out)
         ctx->au_buffer.data = buffer;
         memcpy(ctx->au_buffer.data + ctx->au_buffer.data_size, in->data, nalu_size);
 
-        ctx->au_buffer.data_size += nalu_size;
+        ctx->au_buffer.data_size = data_size;
 
         in->data += nalu_size;
         in->size -= nalu_size;