| Message ID | 20230727023744.20984-1-lq@chinaffmpeg.org |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel] avformat/flvdec: use avio operation instead of pb->buf_ptr use | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Thu, Jul 27, 2023 at 4:38 AM Steven Liu <lq@chinaffmpeg.org> wrote: > > fix segfaults: > READ of size 1 at 0x6100000003b7 thread T0 > #0 0x7f928d in flv_same_video_codec ffmpeg/libavformat/flvdec.c:317:29 > #1 0x7f928d in flv_read_packet ffmpeg/libavformat/flvdec.c:1177 > #2 0x6ff32f in ff_read_packet ffmpeg/libavformat/demux.c:575:15 > #3 0x70a2fd in read_frame_internal ffmpeg/libavformat/demux.c:1263:15 > #4 0x71d158 in avformat_find_stream_info ffmpeg/libavformat/demux.c:2634:15 > #5 0x4c821b in LLVMFuzzerTestOneInput ffmpeg/tools/target_dem_fuzzer.c:206:11 > > Signed-off-by: Steven Liu <lq@chinaffmpeg.org> > --- > libavformat/flvdec.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c > index 3fe21622f7..003e4d7691 100644 > --- a/libavformat/flvdec.c > +++ b/libavformat/flvdec.c > @@ -313,8 +313,9 @@ static int flv_same_video_codec(AVFormatContext *s, AVCodecParameters *vpar, int > return 1; > > if (flv->exheader) { > - uint8_t *codec_id_str = (uint8_t *)s->pb->buf_ptr; > - uint32_t codec_id = codec_id_str[3] | codec_id_str[2] << 8 | codec_id_str[1] << 16 | codec_id_str[0] << 24; > + int64_t pos = avio_tell(s->pb); > + uint32_t codec_id = avio_rb32(s->pb); > + avio_seek(s->pb, pos, SEEK_SET); > switch(codec_id) { > case MKBETAG('h', 'v', 'c', '1'): > return vpar->codec_id == AV_CODEC_ID_HEVC; You don't need to store the position, just do a relative seek backwards by 4 bytes. I would also recommend to include a call to ffio_ensure_seekback so it works with streams. eg. something like this: ffio_ensure_seekback(s->pb, 4); avio_rb32(s->pb); avio_seek(s->pb, -4, SEEK_CUR); Add appropriate error checking, in particular for ffio_ensure_seekback, etc. - Hendrik
Hendrik Leppkes <h.leppkes@gmail.com> 于2023年7月27日周四 14:47写道： Hi Hendrik, > > On Thu, Jul 27, 2023 at 4:38 AM Steven Liu <lq@chinaffmpeg.org> wrote: > > > > fix segfaults: > > READ of size 1 at 0x6100000003b7 thread T0 > > #0 0x7f928d in flv_same_video_codec ffmpeg/libavformat/flvdec.c:317:29 > > #1 0x7f928d in flv_read_packet ffmpeg/libavformat/flvdec.c:1177 > > #2 0x6ff32f in ff_read_packet ffmpeg/libavformat/demux.c:575:15 > > #3 0x70a2fd in read_frame_internal ffmpeg/libavformat/demux.c:1263:15 > > #4 0x71d158 in avformat_find_stream_info ffmpeg/libavformat/demux.c:2634:15 > > #5 0x4c821b in LLVMFuzzerTestOneInput ffmpeg/tools/target_dem_fuzzer.c:206:11 > > > > Signed-off-by: Steven Liu <lq@chinaffmpeg.org> > > --- > > libavformat/flvdec.c | 5 +++-- > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c > > index 3fe21622f7..003e4d7691 100644 > > --- a/libavformat/flvdec.c > > +++ b/libavformat/flvdec.c > > @@ -313,8 +313,9 @@ static int flv_same_video_codec(AVFormatContext *s, AVCodecParameters *vpar, int > > return 1; > > > > if (flv->exheader) { > > - uint8_t *codec_id_str = (uint8_t *)s->pb->buf_ptr; > > - uint32_t codec_id = codec_id_str[3] | codec_id_str[2] << 8 | codec_id_str[1] << 16 | codec_id_str[0] << 24; > > + int64_t pos = avio_tell(s->pb); > > + uint32_t codec_id = avio_rb32(s->pb); > > + avio_seek(s->pb, pos, SEEK_SET); > > switch(codec_id) { > > case MKBETAG('h', 'v', 'c', '1'): > > return vpar->codec_id == AV_CODEC_ID_HEVC; > > You don't need to store the position, just do a relative seek > backwards by 4 bytes. > I would also recommend to include a call to ffio_ensure_seekback so it > works with streams. Thanks for your suggestions. i have resubmit patch v2: https://patchwork.ffmpeg.org/project/ffmpeg/patch/20230727073142.64813-1-lq@chinaffmpeg.org/ > > eg. something like this: > ffio_ensure_seekback(s->pb, 4); > avio_rb32(s->pb); > avio_seek(s->pb, -4, SEEK_CUR); > > Add appropriate error checking, in particular for ffio_ensure_seekback, etc. > > - Hendrik > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". Thanks Steven
diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 3fe21622f7..003e4d7691 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -313,8 +313,9 @@ static int flv_same_video_codec(AVFormatContext *s, AVCodecParameters *vpar, int return 1; if (flv->exheader) { - uint8_t *codec_id_str = (uint8_t *)s->pb->buf_ptr; - uint32_t codec_id = codec_id_str[3] | codec_id_str[2] << 8 | codec_id_str[1] << 16 | codec_id_str[0] << 24; + int64_t pos = avio_tell(s->pb); + uint32_t codec_id = avio_rb32(s->pb); + avio_seek(s->pb, pos, SEEK_SET); switch(codec_id) { case MKBETAG('h', 'v', 'c', '1'): return vpar->codec_id == AV_CODEC_ID_HEVC;
fix segfaults: READ of size 1 at 0x6100000003b7 thread T0 #0 0x7f928d in flv_same_video_codec ffmpeg/libavformat/flvdec.c:317:29 #1 0x7f928d in flv_read_packet ffmpeg/libavformat/flvdec.c:1177 #2 0x6ff32f in ff_read_packet ffmpeg/libavformat/demux.c:575:15 #3 0x70a2fd in read_frame_internal ffmpeg/libavformat/demux.c:1263:15 #4 0x71d158 in avformat_find_stream_info ffmpeg/libavformat/demux.c:2634:15 #5 0x4c821b in LLVMFuzzerTestOneInput ffmpeg/tools/target_dem_fuzzer.c:206:11 Signed-off-by: Steven Liu <lq@chinaffmpeg.org> --- libavformat/flvdec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)