From patchwork Sat May 21 05:21:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Karmani X-Patchwork-Id: 35863 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a21:9992:b0:82:461d:f3b with SMTP id ve18csp919849pzb; Fri, 20 May 2022 22:22:31 -0700 (PDT) X-Google-Smtp-Source: ABdhPJya/d6/Yo/sMDW6D3XuAloBhwuXv2MVvR/cdVL/FCMpR8fkiXaZDWvZx4U0DFakcwPbBXC1 X-Received: by 2002:a17:907:7f0c:b0:6fa:8f52:98fc with SMTP id qf12-20020a1709077f0c00b006fa8f5298fcmr11321354ejc.454.1653110551641; Fri, 20 May 2022 22:22:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1653110551; cv=none; d=google.com; s=arc-20160816; b=V4E7ULXcgaC2taSydc07eUz2Bx4DRxrbt8aB2BJgr3mqfvO8ut+6RDgNufJ4sDNovi hfUPkVc9xklXAGkeGwQ3YBarlcU7F2Fc7pTGq/ofiAcB9X+IB4oXcOcZJ+EGboGcklcq smgJgHepNYMzWvA7OzwTpYQ7PC+cogRi9JfWaIZUl6VfG0F+mF7+gP9Jnrotcat8hIW8 1OdibEk6kRWbtx3MES/MQo31kqMevWnBzHqZiq+uzvRjLhXmg+xb8Lqr9h1HprmZhIvH gm4uBlxnwH0yYQuzB9dFEu/wAVK1RhzGrWI5Y9e7WDcO+kK/UzOlOpF3+m2oswKcctqi 08kA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:to:mime-version:fcc:date:references :in-reply-to:message-id:from:dkim-signature:delivered-to; bh=89mZpGzjOtRjqpzUR+O5C6P5fDYN97LSlQ1VWbJa/n8=; b=FwOwC5R0sWScuejAaHogR/e2zpwMBVk0wnsDehP0MfPRedeSo0MmdvtdTK2eTmkSZf +Eukqe1xFVb/tz3R2ekOqOTUpLobn7Z9xH4xQvXsM9SZQDPEudaQmDMipAZgcWrTkvkl +mIPFwBqxBbzooTIAqWK7O5aOuE87wIScYocdYptT+SACzdt0VK2tNcV7WYdTzBrpV5j ZyQOkEPnMQbxd4AXN3iaScTuxZh7GkMDHFhe1TbLDYe4gn9Lw1EFb6O/iQBdmTa5F7ek aBLLqb1g8F/RonjIRCe2V+iALI9kfMB0+CWvISBiOwonyTLavSPFouqaJIyU1ytLEc9I TJow== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=djULgYf0; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id do18-20020a170906c11200b006fe89b99be7si750109ejc.873.2022.05.20.22.22.30; Fri, 20 May 2022 22:22:31 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=djULgYf0; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 1C9CB68B379; Sat, 21 May 2022 08:21:55 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 52E1A68B49C for ; Sat, 21 May 2022 08:21:47 +0300 (EEST) Received: by mail-pf1-f182.google.com with SMTP id v11so9308071pff.6 for ; Fri, 20 May 2022 22:21:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:message-id:in-reply-to:references:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=D9c7VBND5lM6c2l/hN37gsSq6r7rOHfuot8SuI5nRzI=; b=djULgYf0YvK29VTvigaI0KyYOKAFo9WwEU+g5IWcyfKuPvFrZLtSsGXvr0BNhuwRqt QTqM1wMcteuaiYg+/IvFQb18RK0PGwWRdRIx9TXOYD7+H5wm6sbRNaL2TIfUdlDyaa2k RQ9oYNL+XsW9VXQVNwH+pVQ9Eepw3Go44Ry35beLLK/TAhlkTdy7dRIKxeZic1lhhgBF 1SOMISjgPzaQAxDPi8Sy8VEe6f9V8P7jx/PYs4Tf3EMJ1iyUfSIqETudXgN7umtqm8+G 3KdcTLNuURJFw8VATiL+sVxz6u55FEoUYEH4Ya6Yp+Tl/uoB/DZOanU8Ygy/+nnoZbw4 WkvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:message-id:in-reply-to:references:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=D9c7VBND5lM6c2l/hN37gsSq6r7rOHfuot8SuI5nRzI=; b=63NhR5Zo946v/c7KrL2IwUb8ORlfWeN/zlIyI696rI6FFtv0b71jwKoAeHucUmFT/C gb/PKvWeTy+uQ8eUpkeVEWc3mxpzbjM3JvPXZTK57eM2/BA8VIyehNvG2lw+QbJT9vab pXla+J/pGTn+4hNLhNPvX4AF2xK/0Fvoy+fvLoX57z710oQi3aIScFVLGMSDkZkYLgIs pXzzW1X+6kL/4GGfHETQRBL7ECKdINkj8OkAGxrYDpgw09u0Fd3Dwvus83MJ2gJORJTy ufJzubMGroBqrZUkYkH6OIJaR3R+SPSpY0Ex7D+WCRArdiBOr/G/2gf/hr/Kk0moek2F daSQ== X-Gm-Message-State: AOAM533iOrHwCxC0SMQnBpJg2/6i0a2FT22zt/K+sLmXjgX59ocYz2bo 1XDGB7zgA0hW+uDUFqhGGR2tBMSoIS0PfQ== X-Received: by 2002:a05:6a02:106:b0:36c:96dd:8c17 with SMTP id bg6-20020a056a02010600b0036c96dd8c17mr11732901pgb.190.1653110505604; Fri, 20 May 2022 22:21:45 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id q2-20020a655242000000b003f65560a1a7sm238235pgp.53.2022.05.20.22.21.45 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 May 2022 22:21:45 -0700 (PDT) From: softworkz X-Google-Original-From: softworkz Message-Id: <8aaab15e8b42a4b92df2166c1b393c923249d06a.1653110500.git.ffmpegagent@gmail.com> In-Reply-To: References: Date: Sat, 21 May 2022 05:21:34 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v5 04/10] libavformat/asfdec: fixing get_tag X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Michael Niedermayer , softworkz , Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: ENR0relWLLfs From: softworkz These three are closely related and can't be separated easily: In get_tag, the code was adding 22 bytes (in order to allow it to hold 64bit numbers as string) to the value len for creating creating a buffer. This was unnecessarily imposing a size-constraint on the value_len parameter. The code in get_tag, was limiting the maximum value_len to half the size of INT32. This was applied for all value types, even though it is required only in case of ASF_UNICODE, not for any other ones (like ASCII). get_tag was always allocating a buffer regardless of the datatype, even though this isn't required in case of ASF_BYTE_ARRAY The check for the return value from ff_asf_handle_byte_array() being >0 is removed here because the log message is emitted by the function itself now. Signed-off-by: softworkz --- libavformat/asfdec_f.c | 54 +++++++++++++++++++++++++++++++----------- 1 file changed, 40 insertions(+), 14 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index eda7175c96..cb7da2d679 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -222,37 +222,63 @@ static uint64_t get_value(AVIOContext *pb, int type, int type2_size) static void get_tag(AVFormatContext *s, const char *key, int type, uint32_t len, int type2_size) { ASFContext *asf = s->priv_data; - char *value = NULL; int64_t off = avio_tell(s->pb); -#define LEN 22 - - av_assert0((unsigned)len < (INT_MAX - LEN) / 2); + char *value = NULL; + uint64_t required_bufferlen; + int buffer_len; if (!asf->export_xmp && !strncmp(key, "xmp", 3)) goto finish; - value = av_malloc(2 * len + LEN); + switch (type) { + case ASF_UNICODE: + required_bufferlen = (uint64_t)len * 2 + 1; + break; + case -1: // ASCII + required_bufferlen = (uint64_t)len + 1; + break; + case ASF_BYTE_ARRAY: + ff_asf_handle_byte_array(s, key, len); + goto finish; + case ASF_BOOL: + case ASF_DWORD: + case ASF_QWORD: + case ASF_WORD: + required_bufferlen = 22; + break; + case ASF_GUID: + required_bufferlen = 33; + break; + default: + required_bufferlen = len; + break; + } + + if (required_bufferlen > INT32_MAX) { + av_log(s, AV_LOG_VERBOSE, "Unable to handle values > INT32_MAX in tag %s.\n", key); + goto finish; + } + + buffer_len = (int)required_bufferlen; + + value = av_malloc(buffer_len); if (!value) goto finish; switch (type) { case ASF_UNICODE: - avio_get_str16le(s->pb, len, value, 2 * len + 1); + avio_get_str16le(s->pb, len, value, buffer_len); break; - case -1: // ASCI - avio_read(s->pb, value, len); - value[len]=0; + case -1: // ASCII + avio_read(s->pb, value, buffer_len - 1); + value[buffer_len - 1] = 0; break; - case ASF_BYTE_ARRAY: - if (ff_asf_handle_byte_array(s, key, len) > 0) - av_log(s, AV_LOG_VERBOSE, "Unsupported byte array in tag %s.\n", key); - goto finish; case ASF_BOOL: case ASF_DWORD: case ASF_QWORD: case ASF_WORD: { uint64_t num = get_value(s->pb, type, type2_size); - snprintf(value, LEN, "%"PRIu64, num); + snprintf(value, buffer_len, "%"PRIu64, num); break; } case ASF_GUID: