Message ID | 20240711233417.1896879-13-michael@niedermayer.cc |
---|---|
State | New |
Headers | show
Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:612c:2298:b0:482:c625:d099 with SMTP id fp24csp489445vqb; Thu, 11 Jul 2024 16:44:17 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWE+CT5/9wpv4EhC/jTqF/xxd3pOrq2lzk9c09HR9xJxIjmw2c2cZxm2pxtbvoTQXdNpjffDztunaVG/jUSdyr66Yjyt+egqeiYaw== X-Google-Smtp-Source: AGHT+IFuDEglQ4bU8ARQCDeUxwLMh9GcDNR4nCptdfxuoMIEBhLVGGlsP0BmylArrSWDjq9i/+I2 X-Received: by 2002:a17:906:ae5b:b0:a77:cf9d:f498 with SMTP id a640c23a62f3a-a780b6ff021mr615438866b.40.1720741456717; Thu, 11 Jul 2024 16:44:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1720741456; cv=none; d=google.com; s=arc-20160816; b=t+UtXuF2UaQv67P6FxOJHRMGmjxQCxwdeyFiKUpmvE1KuI3O9mAmcIqyVa/JBTgqi8 VwllNnM4e7NFK+E38xg57PUibDV1VQdwQUHSnZX3tV8aC8DnXh26/8R3S073VTKMaHAL DAUAhwX7pS7vKNwOgqODnEsvvZxZ063uMYC0xpReaTU/1qGEhIGr2d8zYgw9NILXuhkJ /m5e3j0QmW7z1oIQBtw10QejC1Lh37/nTm/BON8PkZq1wovKwlpVujKUSs4+a90zOohI 9pzowORnoLZSWa2vEkhE8yVrEO5RkQczZaJ8qiioInE0t1KV7UbNaiCN+/4CAe3Dd4u/ GIig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:references:in-reply-to:message-id :date:to:from:dkim-signature:delivered-to; bh=3c8DQQXzY7avC/xYsIIHmKA3wYYaOPbUeiQHzBk9jjM=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=UK2vh/X5Wlf3Mjqjw57h302Hxuc8U6+Ws6dHuC8bg4q2mAswwqX1+7ZX8RQRqhA60g R/2XpM5639KIx2yP8VSx+E5er/P08tqwsn4CwkoghahRXSNDG5SUYfbirdSJ+7vIYapx oYtnVWo15WYD0YJAxR8QYn2bk7+HwDFF6jjJ58ciiiKpsmUTUaSvUqGXWYO0YwrNvwWg i7KrmeassOEkrVqQ5iHYgQ5lUDaqOdLjPWUG6hoZACCQHmk+Pjiy5BDLq21UXPLleubq 7s2s5u8WA43WAJFUVkK+4CKRdiAC/cJUy2FdZG/TxYS00KSVj5cbaRMN2huaQ8iD27IE 5bTw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=TAh+Bi+x; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: <ffmpeg-devel-bounces@ffmpeg.org> Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id a640c23a62f3a-a780ab463b1si376516866b.930.2024.07.11.16.44.15; Thu, 11 Jul 2024 16:44:16 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=TAh+Bi+x; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 78AB268DB9E; Fri, 12 Jul 2024 02:34:37 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay6-d.mail.gandi.net (relay6-d.mail.gandi.net [217.70.183.198]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 402C368DB5F for <ffmpeg-devel@ffmpeg.org>; Fri, 12 Jul 2024 02:34:29 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 82443C0006 for <ffmpeg-devel@ffmpeg.org>; Thu, 11 Jul 2024 23:34:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1720740868; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kR1EqomhUBJOguV4jLs+/BCTrDQ1oBR8Cmi8VdhJI7s=; b=TAh+Bi+xB9PdBKEVmg8TThSLe4fFP5TqzzPZEx7zgwrMpx9ggvRVCOt76/U5pNINbc6JwT 4il9xrgHGn6zhlg0sz42SBLw/5or6OdBxjvg5nzhN3IZrpSBAjC3hATp6PTHW52APzx47S oDCUggfdVZTkEbmfINU8A95d1tIUvom7WC6sn55mqYDB3o8sRA38l2Ln9VJ80r6Y4jYfF1 C3lTnJkEu5uchydxVZs6Iuw5reHdF/Vzo92bHTaXwsxCWCGmpO8gBYorS1XC1Q15MbpEiS BF4etqf/P1n4jZTHZObEJ6rdY4vNdDIZwSwgJwD3yCgJ8j+AZW6AG0p+2RVDXg== From: Michael Niedermayer <michael@niedermayer.cc> To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org> Date: Fri, 12 Jul 2024 01:34:07 +0200 Message-ID: <20240711233417.1896879-13-michael@niedermayer.cc> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240711233417.1896879-1-michael@niedermayer.cc> References: <20240711233417.1896879-1-michael@niedermayer.cc> MIME-Version: 1.0 X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 13/22] avformat/siff: Basic pkt_size check X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org> List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>, <mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe> List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel> List-Post: <mailto:ffmpeg-devel@ffmpeg.org> List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help> List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>, <mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe> Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org> Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org> X-TUID: 39eUs9AS6p30 |
Series |
[FFmpeg-devel,01/22] avformat/asfdec_o: Check size of index object
|
expand
|
Context | Check | Description |
---|---|---|
andriy/make_x86 | success | Make finished |
andriy/make_fate_x86 | success | Make fate finished |
diff --git a/libavformat/siff.c b/libavformat/siff.c index 5aad03d870f..b33746d51d2 100644 --- a/libavformat/siff.c +++ b/libavformat/siff.c @@ -199,7 +199,10 @@ static int siff_read_packet(AVFormatContext *s, AVPacket *pkt) if (c->cur_frame >= c->frames) return AVERROR_EOF; if (c->curstrm == -1) { - c->pktsize = avio_rl32(s->pb) - 4; + unsigned pktsize = avio_rl32(s->pb); + if (pktsize < 4) + return AVERROR_INVALIDDATA; + c->pktsize = pktsize - 4; c->flags = avio_rl16(s->pb); if (c->flags & VB_HAS_AUDIO && !c->has_audio) return AVERROR_INVALIDDATA;
Fixes: half of CID1258461 Overflowed constant Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/siff.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)