From patchwork Thu Sep 30 02:58:37 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Soft Works X-Patchwork-Id: 30676 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a6b:6506:0:0:0:0:0 with SMTP id z6csp213539iob; Wed, 29 Sep 2021 19:58:55 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyY71IY6gjpnvVKOKVijfLbHkj8FlfWmHDQ9gf8DRdu38EjNUxvU0TWAGQ08z5e7M+ONhrL X-Received: by 2002:a50:e04e:: with SMTP id g14mr4364018edl.168.1632970735645; Wed, 29 Sep 2021 19:58:55 -0700 (PDT) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id a1si2060312ejx.553.2021.09.29.19.58.55; Wed, 29 Sep 2021 19:58:55 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@hotmail.com header.s=selector1 header.b=YleIwtsq; arc=fail (body hash mismatch); spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=hotmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 3A05168A5F0; Thu, 30 Sep 2021 05:58:44 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from NAM04-MW2-obe.outbound.protection.outlook.com (mail-mw2nam08olkn2086.outbound.protection.outlook.com [40.92.46.86]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 306C668A74F for ; Thu, 30 Sep 2021 05:58:38 +0300 (EEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eGSg08VzCztWEUmfjRNQkVVQI+ZWktmKsXhA+GPunsH1JHU23VAxjAYT0sn9+VMTLVtj9SSaGrSmqJuushsV2yze1tH3k/EHBAmqQ92oo5v7yMrrKJmA8LAH9dkaXDFqbGqfmSyIs8wGDjjS9qcONnmEEBD4cknNaS1cXwViliG7zWaYxbEYA58eT8hxQQdomUnCA1fPWFaMz8t4+uuSktrmlWR1j+BASDS6QTGFuj1WGyEZ4abJZvw6yLHPW7KDIjc39TP05AoEbjTLehEllncwj7TVgzap18UXATZNrqXE4Y6CTtyoEXpN5ZuuvLe2aSwPiQ/E+P54ByK2WggPsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=vk7K51oM0N7qPbay2HcNl/jmF2/pg26rIC/yKFtwymo=; b=jfMmP8w66Ecgwp7tUPMvO1M3TW5R3QM8+kkM1rFK8AVPzJefq2RRwzaJOnrVYMaiep4FsVAT66ODcXMSvyowWGiZBYBhd8imJd68XikbbCYJvDkmB0uWoEcRpDg3zvZVzsl32L20Hhym/qM6UVo7N1rmlWeeX4fGoT7EMeyc2b1MOnT9uwDGyhiUm1QPS129lihCUHDBFWwGyTv5VB3QwnjzFMG2GHlZ8lm9XgKAOlUz0EtSWqKp7Y1Gg5l+M5xsgpvy/XGHoF8PD2wodHbeRSiuD3KeKWhYhXNmKGMj24gv0qUR8n8oz6+BwQHQtE1ivyzPqEYyv9RVyxng/yGrqw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vk7K51oM0N7qPbay2HcNl/jmF2/pg26rIC/yKFtwymo=; b=YleIwtsqNN18jOTRfgsj266hdpC+H407B+xect/Ze8PFid5RvbF8bcaWf/2aVx0NUlLhmJMJT8PBf29cMoNGNUS/vkLWHEMjrR09OLKaln5VZNXWhuBkNHXdDPzj+W0sP4MDn3G8Y6yZmI+Wb4i6b8WodADalVc1/2YoM1oixhF5ohOmzNS+JPlQpVrP6UxDjhZJ3UQ4pfJI07TWu4GcFd8jNSQuw9bMFqY4iTuuLXYiBco/UzYq6eJRcfLnH5JWeHIRtuEma8oJWbtRyW2JoB0VSqD/PsyjymdbjOWQibJ0VX8Oc2nG7NUSSD+mkdkCvv1IK3FyLTnEXbsLK3YIFg== Received: from MN2PR04MB5981.namprd04.prod.outlook.com (2603:10b6:208:da::10) by MN2PR04MB5503.namprd04.prod.outlook.com (2603:10b6:208:e4::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.13; Thu, 30 Sep 2021 02:58:37 +0000 Received: from MN2PR04MB5981.namprd04.prod.outlook.com ([fe80::ecfe:2528:2012:22cb]) by MN2PR04MB5981.namprd04.prod.outlook.com ([fe80::ecfe:2528:2012:22cb%5]) with mapi id 15.20.4544.022; Thu, 30 Sep 2021 02:58:37 +0000 From: Soft Works To: "ffmpeg-devel@ffmpeg.org" Thread-Topic: [PATCH v5 3/7] libavformat/asfdec: Fix type of value_len Thread-Index: AQHXtacQk/0Pen1whEmAgMiBhJfi4w== Date: Thu, 30 Sep 2021 02:58:37 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-tmn: [12S/DU2JuJ7f5XGsR3l0s2hMOJdT/990] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 809ef20f-c3d9-4ce0-37c8-08d983be3331 x-ms-traffictypediagnostic: MN2PR04MB5503: x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ogKNX8pFyJDgyKO02d68KZa6U46k1bW51i18V5lpT2Z6fj+EzSx+NzTY53euVQVzKKVdEWITYMU53mwfJuj+U+qQqR3ja7p6QLEUKvMAx1r0WsMdbB85Nj0TCW9aP6xNIaRH/LMdHHfjN2UTbCQ3Kyo0x10weJURa/1Ba0YMjOeBpCjVk2O3wZqPlX/MfKL/lj/OkdDmBivMgoYrVnUQRO0lgf9F62YyuGuwHkN0JpwDSm44isRdNzGfTCUTLN18nfHqqpr/tWdJoBm0W4LUctpbpUx8yKOj2E5zB/FZrG4fbZXdqLlsTdSn20SjLnzUUp8UEs/MbYlk0SRB9iRC3m3LJ8btjuZ5i3eK2RkZCjMfis4TbR5Obe/RDrvD27zvKtR847qXniis1XH0G64eWyW4cw0GjwKVRqF+N86nvxQD+K1yI+wkRkyqGdhUkEHe x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: 6666qGHxfdzfdw7u9McfUy2GBi7ab2Udge0dqvyf89jclcxqOB6MayucZpwxMvxRad6bqmm/NZilxcTIU4iCZXcC8aQMLXU4zAzXYDb1x5HUFFTTh5kTJX66I19qP7nP/RxxYZicVndd7ujqmhMQ5g== x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: sct-15-20-3174-20-msonline-outlook-529c7.templateTenant X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN2PR04MB5981.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-Network-Message-Id: 809ef20f-c3d9-4ce0-37c8-08d983be3331 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Sep 2021 02:58:37.1506 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR04MB5503 Subject: [FFmpeg-devel] [PATCH v5 3/7] libavformat/asfdec: Fix type of value_len X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: m8+NWe39Ho9h The value_len is an uint32 not an int32 per spec. That value must not be truncated, neither by casting to int, nor by any conditional checks, because at the end of get_tag, this value is needed to move forward in parsing. When the len value gets modified, the parsing may break. Signed-off-by: softworkz --- v5: Split into pieces as requested libavformat/asfdec_f.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index 076b5ab147..d017fae019 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -218,7 +218,7 @@ static uint64_t get_value(AVIOContext *pb, int type, int type2_size) } } -static void get_tag(AVFormatContext *s, const char *key, int type, int len, int type2_size) +static void get_tag(AVFormatContext *s, const char *key, int type, uint32_t len, int type2_size) { ASFContext *asf = s->priv_data; char *value = NULL; @@ -528,7 +528,7 @@ static int asf_read_ext_stream_properties(AVFormatContext *s, int64_t size) static int asf_read_content_desc(AVFormatContext *s, int64_t size) { AVIOContext *pb = s->pb; - int len1, len2, len3, len4, len5; + uint32_t len1, len2, len3, len4, len5; len1 = avio_rl16(pb); len2 = avio_rl16(pb); @@ -602,25 +602,23 @@ static int asf_read_metadata(AVFormatContext *s, int64_t size) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; - int n, stream_num, name_len_utf16, name_len_utf8, value_len; + int n, name_len_utf8; + uint16_t stream_num, name_len_utf16, value_type; + uint32_t value_len; int ret, i; n = avio_rl16(pb); for (i = 0; i < n; i++) { uint8_t *name; - int value_type; avio_rl16(pb); // lang_list_index - stream_num = avio_rl16(pb); - name_len_utf16 = avio_rl16(pb); - value_type = avio_rl16(pb); /* value_type */ - value_len = avio_rl32(pb); + stream_num = (uint16_t)avio_rl16(pb); + name_len_utf16 = (uint16_t)avio_rl16(pb); + value_type = (uint16_t)avio_rl16(pb); /* value_type */ + value_len = avio_rl32(pb); - if (value_len < 0 || value_len > UINT16_MAX) - return AVERROR_INVALIDDATA; - - name_len_utf8 = 2*name_len_utf16 + 1; - name = av_malloc(name_len_utf8); + name_len_utf8 = 2 * name_len_utf16 + 1; + name = av_malloc(name_len_utf8); if (!name) return AVERROR(ENOMEM);