| Message ID | AS8PR01MB79445C44D79B226CA80FF4188FC49@AS8PR01MB7944.eurprd01.prod.exchangelabs.com |
|---|---|
| State | Accepted |
| Commit | 3417379d5e85c026e6eda447ea7fcd3ccccead4a |
| Headers | show |
| Series | [FFmpeg-devel] avformat/dhav: Don't truncate return value of avio_skip() | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
Andreas Rheinhardt: > Fixes demuxing files bigger than INT_MAX. > > Reported-by: jenster > Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> > --- > This has just been reported by jenster on IRC: > > <jenster> I found a bug in libavformat/dhav.c where it fails to demux files > INT_MAX. It's basically assigning the result of avio_skip (which returns an int64_t file offset) to an int in two places which it then checks if it's less than 0 and when the file is bigger than INT_MAX it overflows and becomes negative and errors out (this seems like something > <jenster> that static analysis should find). It's a two line fix (basically just change two ints to int64_t) https://pastebin.com/iUGe9cza (licensed CC0). Would anyone be able to submit this change or fix it their own way? I don't care about credit and I really don't want to bother with the whole patch submission process for this trivial change. > > libavformat/dhav.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/libavformat/dhav.c b/libavformat/dhav.c > index 60aab8cabd..9d26efe8fc 100644 > --- a/libavformat/dhav.c > +++ b/libavformat/dhav.c > @@ -78,10 +78,11 @@ static const uint32_t sample_rates[] = { > static int parse_ext(AVFormatContext *s, int length) > { > DHAVContext *dhav = s->priv_data; > - int index, ret = 0; > + int64_t ret = 0; > > while (length > 0) { > int type = avio_r8(s->pb); > + int index; > > switch (type) { > case 0x80: > @@ -168,8 +169,7 @@ static int read_chunk(AVFormatContext *s) > { > DHAVContext *dhav = s->priv_data; > int frame_length, ext_length; > - int64_t start, end; > - int ret; > + int64_t start, end, ret; > > if (avio_feof(s->pb)) > return AVERROR_EOF; Will apply later today unless there are objections. - Andreas
diff --git a/libavformat/dhav.c b/libavformat/dhav.c index 60aab8cabd..9d26efe8fc 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -78,10 +78,11 @@ static const uint32_t sample_rates[] = { static int parse_ext(AVFormatContext *s, int length) { DHAVContext *dhav = s->priv_data; - int index, ret = 0; + int64_t ret = 0; while (length > 0) { int type = avio_r8(s->pb); + int index; switch (type) { case 0x80: @@ -168,8 +169,7 @@ static int read_chunk(AVFormatContext *s) { DHAVContext *dhav = s->priv_data; int frame_length, ext_length; - int64_t start, end; - int ret; + int64_t start, end, ret; if (avio_feof(s->pb)) return AVERROR_EOF;
Fixes demuxing files bigger than INT_MAX. Reported-by: jenster Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> --- This has just been reported by jenster on IRC: <jenster> I found a bug in libavformat/dhav.c where it fails to demux files > INT_MAX. It's basically assigning the result of avio_skip (which returns an int64_t file offset) to an int in two places which it then checks if it's less than 0 and when the file is bigger than INT_MAX it overflows and becomes negative and errors out (this seems like something <jenster> that static analysis should find). It's a two line fix (basically just change two ints to int64_t) https://pastebin.com/iUGe9cza (licensed CC0). Would anyone be able to submit this change or fix it their own way? I don't care about credit and I really don't want to bother with the whole patch submission process for this trivial change. libavformat/dhav.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)