From patchwork Sat May 7 09:36:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Karmani X-Patchwork-Id: 35625 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:a885:b0:7f:4be2:bd17 with SMTP id ca5csp2088450pzb; Sat, 7 May 2022 02:37:20 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz9r6dFjIZ4NOAPFyhZuVbhEiTKDpV9Z2odP/BODngtjlHESqNpKSSuIBungLg7qind/6vd X-Received: by 2002:a17:906:8696:b0:6f3:a043:6ea7 with SMTP id g22-20020a170906869600b006f3a0436ea7mr6696296ejx.387.1651916239853; Sat, 07 May 2022 02:37:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651916239; cv=none; d=google.com; s=arc-20160816; b=vSeADVcUTJrEu5OnntDPgxGDG3jCJAMAEiVOKs8isHbsRbYCnGyoFwdR99S+fxX3Qr VZ3C7b8/QpeMhVydK0hYYd98k5r/gMp/b1em1cdj297zTLAcApn5c4QVS6o99kLlF8Eh 93FGl5jLLyaZ59gdsNPKSBQ91JQScJWWYytgvvOfNKwmNt7uj+m/3ZncAbnbDGMVaIyW vFGTKlvaBg52kl4cm6W6RibhmttsAQreMxJx2D44vvbKNJEyjgRXCtSexM3B+ttKM6m4 oX2+f+LTlV4EWYOEttXLzLhFB6ZzHLGQ+xFoQktX9x5iyc5b1hYsDcVebfPHNdAOUeep RekA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:to:mime-version:fcc:date:references :in-reply-to:message-id:from:dkim-signature:delivered-to; bh=TRgRddJvhdT8D8K+JVZaaV5n5DYKvOv23vCpDZfXMRY=; b=BQOsSE6zLDJaoWwLXxmKeAi2Ap8mpidZw6qI0Sdh+VnfxSfHdc89fbxWsFlO63yjvy G4ixfcdLC9ThQnmvcXA5ZtoQw+Fv3C+JD6xE1LEyvihNuDMdLqpZSW1UGee/KQew3dMO qWVqZb2klKGzENNOMd0LdI0Zg1BesgbcFgVXct06UqcEOAGFOVBW2dcO7xzb9KhCGzRo utjsFYeaUWc51qAOYw8YTCo0Q7A4D9j4wm78jEVRQdo+aNpTTLmzg/V1vGR0EqRyNXxl bAraj9eUpSdObIUARbktweWE2HgxlC1hzwlTIRk07Lcfo9z8163mACAaqmaFzWsMTfUp fYog== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=ScbY9n8c; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id i2-20020a170906444200b006f3ab6a51dasi7534041ejp.661.2022.05.07.02.37.19; Sat, 07 May 2022 02:37:19 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=ScbY9n8c; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 07FFF68B245; Sat, 7 May 2022 12:36:58 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 9830268B140 for ; Sat, 7 May 2022 12:36:50 +0300 (EEST) Received: by mail-pj1-f50.google.com with SMTP id p6so9075839pjm.1 for ; Sat, 07 May 2022 02:36:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:message-id:in-reply-to:references:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=BO4GMaYMoGchgpoFFQn6PH6TQ7dwl6Vtng+ZiBb8A5g=; b=ScbY9n8cdip1O1s1NZlWSNLvBckeWSBt3R07YjpU3tyXjycqGOLXZjR+TKWSxRCP4q aCaNFLXsNff7bTxD9KlOKWM0idY14tkOHZkLBqnAf4T2CP4oFwrSzTtE/s3/w79E+xKm bVz4YmdjGDArvQL1qMLSsX28mGzJ03tlqhBkbb2+YZWdd2rlfMyHEsqVLXcRYJi7Khf8 odKiXUUKY2fWRMoiLQPpWgPsVKJvT7dKtwxhPG4udjt+U9+2z44F8wLF75VwGXKvL71g yVbh5p50ZAnKjj0QAl+0CfGCXuiBZvUja8IAZVPPVU7p17y8HaKu6R6w1g9coPC7kcgC qw2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:message-id:in-reply-to:references:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=BO4GMaYMoGchgpoFFQn6PH6TQ7dwl6Vtng+ZiBb8A5g=; b=WthlS2kkEXToSXfR+cYBtwObHXabYRUVURlceEYcNzevpBOCBizI/xWc5ZbXjdhZ2S JZYrmDYgbN0oiieThfrVBqiPjU1wNnZrownR8oelFAz8+IKiHl09GtugD5Wt1tlan4qS zSajgtuYasqCjMO78MtmtxPSlNuu0mZx87zOJDbw92szdyXo4vkDlm4L/u75Uukj/Hql uT5HwxZfaseEsiGTfpuIx/JETUcq7b526QLIxWZmajiudrxbJZagQW8HOiV8/JBJpFuX 6Jbsxd+O1YSCTcT/mMmbVXn5YUkjXRuaWGWztWwa0pWiKLDSj0qlxUnscm3BSnK6563F b7Bw== X-Gm-Message-State: AOAM532ikKl87j44szy0t+O1wbZlcDYLczr7tnF6xIyGHgVVYEyXpcEF xrMefWE3NJMLUvJRYiwuDV9suL/WFNPgNg== X-Received: by 2002:a17:90b:3a8b:b0:1dc:444a:df66 with SMTP id om11-20020a17090b3a8b00b001dc444adf66mr16964693pjb.166.1651916209094; Sat, 07 May 2022 02:36:49 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id 2-20020a17090a194200b001cd4989ff4esm5081123pjh.21.2022.05.07.02.36.48 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 07 May 2022 02:36:48 -0700 (PDT) From: softworkz X-Google-Original-From: softworkz Message-Id: In-Reply-To: References: Date: Sat, 07 May 2022 09:36:35 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v2 02/11] libavformat/asfdec: fix get_value return type and add checks for X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: softworkz Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: sw4g0WJXikng From: softworkz unsupported values get_value had a return type of int, which means that reading QWORDS (case 4) was broken due to truncation of the result from avio_rl64(). Signed-off-by: softworkz --- libavformat/asfdec_f.c | 38 +++++++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index a8f36ed286..d31e1d581d 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -202,7 +202,7 @@ static int asf_probe(const AVProbeData *pd) /* size of type 2 (BOOL) is 32bit for "Extended Content Description Object" * but 16 bit for "Metadata Object" and "Metadata Library Object" */ -static int get_value(AVIOContext *pb, int type, int type2_size) +static uint64_t get_value(AVIOContext *pb, int type, int type2_size) { switch (type) { case ASF_BOOL: @@ -567,10 +567,22 @@ static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) /* My sample has that stream set to 0 maybe that mean the container. * ASF stream count starts at 1. I am using 0 to the container value * since it's unused. */ - if (!strcmp(name, "AspectRatioX")) - asf->dar[0].num = get_value(s->pb, value_type, 32); - else if (!strcmp(name, "AspectRatioY")) - asf->dar[0].den = get_value(s->pb, value_type, 32); + if (!strcmp(name, "AspectRatioX")) { + const uint64_t value = get_value(s->pb, value_type, 32); + if (value > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", value); + return AVERROR(ENOTSUP); + } + asf->dar[0].num = (int)value; + } + else if (!strcmp(name, "AspectRatioY")) { + const uint64_t value = get_value(s->pb, value_type, 32); + if (value > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", value); + return AVERROR(ENOTSUP); + } + asf->dar[0].den = (int)value; + } else get_tag(s, name, value_type, value_len, 32); } @@ -630,13 +642,21 @@ static int asf_read_metadata(AVFormatContext *s, int64_t size) i, stream_num, name_len_utf16, value_type, value_len, name); if (!strcmp(name, "AspectRatioX")){ - int aspect_x = get_value(s->pb, value_type, 16); + const uint64_t aspect_x = get_value(s->pb, value_type, 16); + if (aspect_x > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", aspect_x); + return AVERROR(ENOTSUP); + } if(stream_num < 128) - asf->dar[stream_num].num = aspect_x; + asf->dar[stream_num].num = (int)aspect_x; } else if(!strcmp(name, "AspectRatioY")){ - int aspect_y = get_value(s->pb, value_type, 16); + const uint64_t aspect_y = get_value(s->pb, value_type, 16); + if (aspect_y > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", aspect_y); + return AVERROR(ENOTSUP); + } if(stream_num < 128) - asf->dar[stream_num].den = aspect_y; + asf->dar[stream_num].den = (int)aspect_y; } else { get_tag(s, name, value_type, value_len, 16); }