From patchwork Sat May 21 05:21:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Karmani X-Patchwork-Id: 35860 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a21:9992:b0:82:461d:f3b with SMTP id ve18csp919760pzb; Fri, 20 May 2022 22:22:03 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzBzU3gEzYaeHIbmOVxHRcQ6Js/LuF4ffhp00BuOuwQ9Zh0jXQXMyVOz5qBN7thX6+pbbNn X-Received: by 2002:a17:907:7da7:b0:6f4:f92b:3986 with SMTP id oz39-20020a1709077da700b006f4f92b3986mr11319908ejc.50.1653110523382; Fri, 20 May 2022 22:22:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1653110523; cv=none; d=google.com; s=arc-20160816; b=EeGlxwKfBOpBuUGpF6PQ0kBlSeC1MZkcLFpj7a1diyHEnTyUNQyxeErOPhOw3otV5Q mvrLJnFT1gV4CIAf3a/ZOMptWGPibhfMO1Jq4KQMMaaXroFuyPknnPy0CAVkzWhNDx3e GiJQKUYZANCpo1tV+Jh0NvXKH6yJUcPCflF+RNE3aw6dJB8k70TBHj37JhuW6yHM46rp BhvIYVIv/E7QaTu60i0TyeB7NpWaV/+SjFtkP5NHK5SpLx2K/h02jAUXfXdyF7WjiuQA MThVsMVM66vUZ5EKSsv2cVi14RVRgIXeckJk0BI3y877NZEsuSvVNKm4+7PdL7saARFt DzTA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:to:mime-version:fcc:date:references :in-reply-to:message-id:from:dkim-signature:delivered-to; bh=dhmMOaaSHCq3yozQzYCP2Kk3X9sy5Rgu/Ld4by622F8=; b=FEeRibY36QVPPeN04odg5tdZuj7xzZimEd1PahnEayN3CbZHhugpvnl8Po5BBQTfhR OWi/vt6WMd/nUnqOS7gaNZzGT+vKqzb3ZOPhmBTamtDtm8T+j7PWaon6Bwj9IzvggUCW hwp8jKjuGOalHbec2C30RJn8+URoG4zU2sEnXuY1g+e8T8NtADAUDgXv2+oyQ+5p7O3l coJqzY4e0YLNiGZO+FirQ72Lh9zRCMjKB9AFN/O7oSbukPGgTQDwTNtVIMR2IN1nYoWc nHQbNHqKQ1wno6aAJLvyl51htroGocdnbNWQtClaOMMe3b9x3tA1G0u9OcggyckdFvz6 mG+g== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=Dn5xLYnn; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id dn24-20020a05640222f800b0042ae30a77f2si9079251edb.398.2022.05.20.22.22.03; Fri, 20 May 2022 22:22:03 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=Dn5xLYnn; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 38D4368B4BC; Sat, 21 May 2022 08:21:51 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6773868B379 for ; Sat, 21 May 2022 08:21:44 +0300 (EEST) Received: by mail-pl1-f180.google.com with SMTP id m12so8893401plb.4 for ; Fri, 20 May 2022 22:21:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:message-id:in-reply-to:references:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=Xarnv5vIwXMy5lH5rxP7K+aIHzBAnNq8DgFofdT+WwQ=; b=Dn5xLYnnw2AHcJC1iLc3LhlZ0wMSlUVLkMCp+DaTmpfqasATrKCTMqk59alYWB9Rdk wuID7P2yZRT2NHCEDlfhTrbxM8g/0YTnIPjaWokuHS5QejDVBwa2LXRo6rUFQK08vUtS 2zp/U+YUjnrKoW7gwD91+9ssrf6pw56xYyItrHe+KBgrLhlFmzTSGESW7OdxVVvGdC1f d8ps/rQBjd3tXCy421XuJ/Ehb4LbLOkRSpp7OU6+irlx7Ch1y4uzZLG00UpCdE0CWdT7 xRG9uGLwEgqiSOpimavN+wcF/5UgteH71n1yeUizGUEuwAzxwXbN2jBJUuqGNM+Ohrcf QEFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:message-id:in-reply-to:references:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=Xarnv5vIwXMy5lH5rxP7K+aIHzBAnNq8DgFofdT+WwQ=; b=oj7RcEG/vgP3XnDyKGgMNmpWG3RGC6zLuUl1Mdl1H1gcKLOGuUHlmZnj1YnGtMbfSy MFLkdVzqZOlBOuegTxfB27IC7Yf3MqCELY/NzfCRA58VJuZOvMwvgc9LCiySXBUy/82W mGD0S+DTomP4RUTlcgCg/grn4ZhFdfNEaUY0DYeIsY4lLfqSJv7EUVodMixCQkhbR05J ZjCrt8n8NufWrJmeGtgnSNV0BxZ17ckr2Qo+RZPGpsZrz9y6y6aXds/kJzq/eHnnPZtH eR0TLFlHiiLCmbSRRoKLOEe3PbXHIqMR+lbiappkR7vJpFkM1LG/rFFBbO2wXKSNMnFE /+JQ== X-Gm-Message-State: AOAM532x0QL4PxaLEFQN6db5urCOtmSPz5Nqf+9lcEgbGBAFbPxKsdiP C4YZECyJQsSLGTj2QYu2te7/WuggYBRk6A== X-Received: by 2002:a17:902:e948:b0:15e:cd79:2a1a with SMTP id b8-20020a170902e94800b0015ecd792a1amr12634962pll.109.1653110502467; Fri, 20 May 2022 22:21:42 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id x26-20020aa7941a000000b0050dc76281f0sm2685668pfo.202.2022.05.20.22.21.41 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 May 2022 22:21:42 -0700 (PDT) From: softworkz X-Google-Original-From: softworkz Message-Id: <7505ffa3c5de269cd850dd577b0ffdb6f79dd36f.1653110500.git.ffmpegagent@gmail.com> In-Reply-To: References: Date: Sat, 21 May 2022 05:21:31 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v5 01/10] libavformat/asf: fix handling of byte array length values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Michael Niedermayer , softworkz , Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: 4v3q5Kk+8hMG From: softworkz The spec allows attachment sizes of up to UINT32_MAX while we can handle only sizes up to INT32_MAX (in downstream code) The debug.assert in get_tag didn't really address this, and truncating the value_len in calling methods cannot be used because the length value is required in order to continue parsing. This adds a check with log message in ff_asf_handle_byte_array to handle those (rare) cases. Signed-off-by: softworkz --- libavformat/asf.c | 8 +++++++- libavformat/asf.h | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/asf.c b/libavformat/asf.c index 1285062220..bec7db0c7e 100644 --- a/libavformat/asf.c +++ b/libavformat/asf.c @@ -139,12 +139,18 @@ static int get_id3_tag(AVFormatContext *s, int len) } int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, - int val_len) + uint32_t val_len) { + if (val_len > INT32_MAX) { + av_log(s, AV_LOG_VERBOSE, "Unable to handle byte arrays > INT32_MAX in tag %s.\n", name); + return 1; + } + if (!strcmp(name, "WM/Picture")) // handle cover art return asf_read_picture(s, val_len); else if (!strcmp(name, "ID3")) // handle ID3 tag return get_id3_tag(s, val_len); + av_log(s, AV_LOG_DEBUG, "Unsupported byte array in tag %s.\n", name); return 1; } diff --git a/libavformat/asf.h b/libavformat/asf.h index 01cc4f7a46..4d28560f56 100644 --- a/libavformat/asf.h +++ b/libavformat/asf.h @@ -111,7 +111,7 @@ extern const AVMetadataConv ff_asf_metadata_conv[]; * is unsupported by this function and 0 otherwise. */ int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, - int val_len); + uint32_t val_len); #define ASF_PACKET_FLAG_ERROR_CORRECTION_PRESENT 0x80 //1000 0000