| Message ID | 4d40d677-6095-2b4d-e7f3-7b3c88814aeb@gyani.pro |
|---|---|
| State | Accepted |
| Commit | 87db1ca632bfbb66329c5729301d88ca30bed9b3 |
| Headers | show |
On 10-05-2019 07:25 PM, Gyan wrote: > At present, if the command args passed to drawtext contain any invalid > values, ffmpeg may crash or, at best, stop drawing any text. > Attached patch gets the filter to continue with existing parameters, > if not all of the changes can be parsed or applied. This allows users > in live processing to correct and resubmit. Ping.
On Mon, May 13, 2019 at 4:06 AM Gyan <ffmpeg@gyani.pro> wrote: > > > > On 10-05-2019 07:25 PM, Gyan wrote: > > At present, if the command args passed to drawtext contain any invalid > > values, ffmpeg may crash or, at best, stop drawing any text. > > Attached patch gets the filter to continue with existing parameters, > > if not all of the changes can be parsed or applied. This allows users > > in live processing to correct and resubmit. > > Ping. Tested and verified, LGTM, Thanks
On 13-05-2019 06:54 AM, mypopy@gmail.com wrote: > On Mon, May 13, 2019 at 4:06 AM Gyan <ffmpeg@gyani.pro> wrote: >> >> >> On 10-05-2019 07:25 PM, Gyan wrote: >>> At present, if the command args passed to drawtext contain any invalid >>> values, ffmpeg may crash or, at best, stop drawing any text. >>> Attached patch gets the filter to continue with existing parameters, >>> if not all of the changes can be parsed or applied. This allows users >>> in live processing to correct and resubmit. >> Ping. > Tested and verified, LGTM, Thanks Pushed as 87db1ca632bfbb66329c5729301d88ca30bed9b3 Thanks, Gyan
On 10/05/2019 15:55, Gyan wrote: > At present, if the command args passed to drawtext contain any invalid > values, ffmpeg may crash or, at best, stop drawing any text. > Attached patch gets the filter to continue with existing parameters, if > not all of the changes can be parsed or applied. This allows users in > live processing to correct and resubmit. > > Gyan This patch has at least two mis-uses of av_freep(), which potentially lead to a crash. > + av_freep(old); > + > + ctx->priv = new; Should probably be av_freep(&old); > +fail: > + av_log(ctx, AV_LOG_ERROR, "Failed to process command. Continuing with existing parameters.\n"); > + av_freep(new); > + return ret; Should probably be av_freep(&new); I did not do a full review of the patch, just pointing out those issues Coverity found. See coverity CID 1445099. Timo
On 14-05-2019 02:03 PM, Timo Rothenpieler wrote: > On 10/05/2019 15:55, Gyan wrote: >> At present, if the command args passed to drawtext contain any >> invalid values, ffmpeg may crash or, at best, stop drawing any text. >> Attached patch gets the filter to continue with existing parameters, >> if not all of the changes can be parsed or applied. This allows users >> in live processing to correct and resubmit. >> >> Gyan > > This patch has at least two mis-uses of av_freep(), which potentially > lead to a crash. > >> + av_freep(old); >> + >> + ctx->priv = new; > > Should probably be av_freep(&old); > >> +fail: >> + av_log(ctx, AV_LOG_ERROR, "Failed to process command. Continuing >> with existing parameters.\n"); >> + av_freep(new); >> + return ret; > > Should probably be av_freep(&new); > Will push these soon. > I did not do a full review of the patch, just pointing out those > issues Coverity found. See coverity CID 1445099. Requested Coverity access via Synopsys. Gyan
diff --git a/libavfilter/vf_drawtext.c b/libavfilter/vf_drawtext.c index cca2cbcb88..b166574d71 100644 --- a/libavfilter/vf_drawtext.c +++ b/libavfilter/vf_drawtext.c @@ -862,20 +862,49 @@ static int config_input(AVFilterLink *inlink) static int command(AVFilterContext *ctx, const char *cmd, const char *arg, char *res, int res_len, int flags) { - DrawTextContext *s = ctx->priv; + DrawTextContext *old = ctx->priv; + DrawTextContext *new = NULL; + int ret; if (!strcmp(cmd, "reinit")) { - int ret; + new = av_mallocz(sizeof(DrawTextContext)); + if (!new) + return AVERROR(ENOMEM); + + new->class = &drawtext_class; + ret = av_opt_copy(new, old); + if (ret < 0) + goto fail; + + ctx->priv = new; + ret = av_set_options_string(ctx, arg, "=", ":"); + if (ret < 0) { + ctx->priv = old; + goto fail; + } + + ret = init(ctx); + if (ret < 0) { + uninit(ctx); + ctx->priv = old; + goto fail; + } + + new->reinit = 1; + + ctx->priv = old; uninit(ctx); - s->reinit = 1; - if ((ret = av_set_options_string(ctx, arg, "=", ":")) < 0) - return ret; - if ((ret = init(ctx)) < 0) - return ret; + av_freep(old); + + ctx->priv = new; return config_input(ctx->inputs[0]); - } + } else + return AVERROR(ENOSYS); - return AVERROR(ENOSYS); +fail: + av_log(ctx, AV_LOG_ERROR, "Failed to process command. Continuing with existing parameters.\n"); + av_freep(new); + return ret; } static int func_pict_type(AVFilterContext *ctx, AVBPrint *bp,
At present, if the command args passed to drawtext contain any invalid values, ffmpeg may crash or, at best, stop drawing any text. Attached patch gets the filter to continue with existing parameters, if not all of the changes can be parsed or applied. This allows users in live processing to correct and resubmit. Gyan From 57cb3a085363602877790945b619c92b0fedddcd Mon Sep 17 00:00:00 2001 From: Gyan Doshi <ffmpeg@gyani.pro> Date: Fri, 10 May 2019 19:13:33 +0530 Subject: [PATCH] avfilter/drawtext: make command processing error-resilient Prevents crash or blank-out if new option string contains invalid values. --- libavfilter/vf_drawtext.c | 47 +++++++++++++++++++++++++++++++-------- 1 file changed, 38 insertions(+), 9 deletions(-)