From patchwork Fri Jan 6 20:27:29 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Cadhalpun X-Patchwork-Id: 2087 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.89.21 with SMTP id n21csp5990864vsb; Fri, 6 Jan 2017 12:27:40 -0800 (PST) X-Received: by 10.28.152.79 with SMTP id a76mr163958wme.47.1483734460888; Fri, 06 Jan 2017 12:27:40 -0800 (PST) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id 3si1560880wrr.155.2017.01.06.12.27.40; Fri, 06 Jan 2017 12:27:40 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@googlemail.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE dis=NONE) header.from=googlemail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0B34568A2BA; Fri, 6 Jan 2017 22:27:32 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm0-f66.google.com (mail-wm0-f66.google.com [74.125.82.66]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 2513E68A2B3 for ; Fri, 6 Jan 2017 22:27:26 +0200 (EET) Received: by mail-wm0-f66.google.com with SMTP id l2so7580233wml.2 for ; Fri, 06 Jan 2017 12:27:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20161025; h=from:subject:to:references:message-id:date:user-agent:mime-version :in-reply-to; bh=b5Vs0LBwmmiL4dG7tjDNDF7fNjnzGRB22ye0W0mT1LE=; b=SqmL2PoCMd696ttPgk40EnT2YanaGHybP/UUwPa7NPS6zwWYWCeMLYvQuJtzhKpY38 1fpkSSUOgrIMkVNbIPO2+PBaNMI7aG7zW8gud0nD8CyaZ7n8IaHmkexpkVvx26D0kxdU mNpXLRu9yj5MA2tcf9nlV7Uhc/UA5ggVGrk5YJnm3mQEfIit5wWN1ns8L629TpcnUaFd tRAzeVK94N3PpEtxpuN+b7zfgOjrDIvYzRx5w43UoH7j9ot968CsZIzQXUBBQmpOpRWL 4Xg86S9ioDAvl4z6aFyLYW8o3HR7efjhcsJ4OXmmh/mm863HQ24oiUVY2Ltu/QoyOR5R HlQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:subject:to:references:message-id:date :user-agent:mime-version:in-reply-to; bh=b5Vs0LBwmmiL4dG7tjDNDF7fNjnzGRB22ye0W0mT1LE=; b=bvVUhjGSYVn4yW9uEpFC5iVG949nJzlvnZ7P36Drtb+xZGg+GcxjBroWcl7u994Z+K VS56qB/BEk1KgUMOJG5XumC6LkR6mTBzQgntqAc9euVktmhQF87/KmHlE5ksutX9WyB2 88oWA+h2miCU+PDWWLsyMDGDhNbqCrzVJXsGNs/HSAgm6DmC91LzG0JYaFKoU9O7F4rH k2LVecQ28VlbdU+smtymm5bLz7F6vSxc6RU8vKbXhc+xOkcfBtJJhgO21BpFmfK2OloF 1qScciHBwKXxyaabPj4K08BA67K23+rlMOHc5ae3ZdrPc/7IxfC8Atrw7HIJAQ09tVoJ jAIw== X-Gm-Message-State: AIkVDXJ0MLvhoHZVhGG5CwqI0ztabwMqNzsuCADqg8qnFi2TPFIuDUlhZ2ATz8jB8cyBEA== X-Received: by 10.223.153.248 with SMTP id y111mr2997320wrb.174.1483734451341; Fri, 06 Jan 2017 12:27:31 -0800 (PST) Received: from [192.168.2.21] (p5B072B3E.dip0.t-ipconnect.de. [91.7.43.62]) by smtp.googlemail.com with ESMTPSA id y4sm110388932wjp.0.2017.01.06.12.27.30 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 06 Jan 2017 12:27:30 -0800 (PST) From: Andreas Cadhalpun X-Google-Original-From: Andreas Cadhalpun To: ffmpeg-devel@ffmpeg.org References: <8f290505-70a1-d5b0-cbcf-96522ab12ce4@googlemail.com> Message-ID: <38f981e9-5259-6197-3589-bd30d7238811@googlemail.com> Date: Fri, 6 Jan 2017 21:27:29 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.4.0 MIME-Version: 1.0 In-Reply-To: Subject: Re: [FFmpeg-devel] [PATCH 2/9] 4xm: prevent overflow during block alignment calculation X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" On 06.01.2017 20:58, Ronald S. Bultje wrote: > Hi, > > On Fri, Jan 6, 2017 at 2:47 PM, Andreas Cadhalpun < > andreas.cadhalpun@googlemail.com> wrote: > >> Signed-off-by: Andreas Cadhalpun >> --- >> libavformat/4xm.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/libavformat/4xm.c b/libavformat/4xm.c >> index 2758b69d29..45949c4e97 100644 >> --- a/libavformat/4xm.c >> +++ b/libavformat/4xm.c >> @@ -187,6 +187,7 @@ static int parse_strk(AVFormatContext *s, >> st->codecpar->bit_rate = (int64_t)st->codecpar->channels >> * >> st->codecpar->sample_rate * >> st->codecpar->bits_per_coded_ >> sample; >> + FF_RETURN_ON_OVERFLOW(s, st->codecpar->channels && >> st->codecpar->bits_per_coded_sample > INT_MAX / st->codecpar->channels) >> st->codecpar->block_align = st->codecpar->channels * >> st->codecpar->bits_per_coded_ >> sample; >> >> -- >> 2.11.0 > > > To an innocent reader (who doesn't know/care about SIGFPE), this might look > like channels = 0 is an actual valid decoder condition that is explicitly > handled here. Actually this function errors out earlier if channels is zero, so I've removed this pointless additional check. Updated patch is attached. Best regards, Andreas From 861b62eec30feaa56b10eec7ba4029daf48a3c28 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Thu, 15 Dec 2016 02:14:31 +0100 Subject: [PATCH 2/9] 4xm: prevent overflow during block alignment calculation Signed-off-by: Andreas Cadhalpun --- libavformat/4xm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/4xm.c b/libavformat/4xm.c index 2758b69d29..58729fed0d 100644 --- a/libavformat/4xm.c +++ b/libavformat/4xm.c @@ -187,6 +187,7 @@ static int parse_strk(AVFormatContext *s, st->codecpar->bit_rate = (int64_t)st->codecpar->channels * st->codecpar->sample_rate * st->codecpar->bits_per_coded_sample; + FF_RETURN_ON_OVERFLOW(s, st->codecpar->bits_per_coded_sample > INT_MAX / st->codecpar->channels) st->codecpar->block_align = st->codecpar->channels * st->codecpar->bits_per_coded_sample; -- 2.11.0