From patchwork Sun May 8 03:01:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Karmani X-Patchwork-Id: 35687 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:a885:b0:7f:4be2:bd17 with SMTP id ca5csp2386857pzb; Sat, 7 May 2022 20:01:45 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxcpqbYUQKIb1RDbnKFj/bCZnGziK2TSk4WC6hXhATWLqsltSA95hKSndqNNbzGKZklEbsH X-Received: by 2002:a05:6402:288a:b0:425:c5b2:59d9 with SMTP id eg10-20020a056402288a00b00425c5b259d9mr10778518edb.412.1651978905137; Sat, 07 May 2022 20:01:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651978905; cv=none; d=google.com; s=arc-20160816; b=GYNqhIS7VlbCc9iGD8clcL70/SrDp1iY/NfA+vqKzG624FElKWQC8sk9yPr8yrOQEU gszd3kqFgkwtrkikvDxUW9bznGR5rLhGJvCpSByAH0broN557jHkLogi0nDQVXnpkZwW MEbVdmnpKtQThiLIhzG1FXQSiWNQWqwzk6UDo7uZrYOEoPdo1L3E0ZJph4kiBW9iETgf N1bgQFpQrrkun1jEemjgDblLTodqETsAgVIii73pEER805PlXi343na5wNNlbtyhPZOf Y3lJ9TQ1Dnm4sNqWmGfAcegBaXGjNvBdbpGZXMVw6RwTbIGv2e/rD/HfbmkHF0eXdJkd qd9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:to:mime-version:fcc:date:references :in-reply-to:message-id:from:dkim-signature:delivered-to; bh=Pu1Jcy+30g6WPvZ0mtQrKZqlUMuu81DxWyn4e6o0wNo=; b=cVCMvwn/XAJboHWPWMzOi9+sxwoQaSb5hi6RHuzBYkW1//a1brLIJhCZ1MSzw0190O PSxUYuob642xwCvAqAELdjlwjYdp9BxIsMLqRVP3qjCtQE7lmPWDHZqXgQmPe2ifXJ4y ahOOoiepIHjF7ZJNMD+WHRxcX1SqN8qdVDjwZZbSW2seB4KgetdhycphE9QTDqBR5iz+ kEj4vwY5EoqPjrzZXs95OC/fxTuVCvpFUuiw0fx/uXqlde6kqQs+rA0A2rhsZO5IHmJ2 NN2DPS0wad7n0GcWJplpGyYZM6ey8awLsHnUkVHKpMJ4Np1nwIH+ivq2IIC2wYTsc7Zn 5gqQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=lGIwKmWO; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id gk20-20020a17090790d400b006f38e90d86fsi8677794ejb.256.2022.05.07.20.01.44; Sat, 07 May 2022 20:01:45 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=lGIwKmWO; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 7A7CC68B308; Sun, 8 May 2022 06:01:33 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 7B6D968A466 for ; Sun, 8 May 2022 06:01:26 +0300 (EEST) Received: by mail-pl1-f173.google.com with SMTP id n8so10986350plh.1 for ; Sat, 07 May 2022 20:01:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:message-id:in-reply-to:references:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=MJnXMdit3nZo4IX2PgJfiVDx0wgidIDVebfIhz4u6FU=; b=lGIwKmWOgNtNo7U2h4I3c+3ppQrEELFF4Eqy3u4FaQp5ZP1XIIjWjBMzmY2fHpsZAR pl5EtgNtpDE0TyBVExoUPO7BUgdWJFZbD8B7WOYnhGZQMKc7kvjniA6pYrhygEX81WZV xFoTrAg0UVgp3fCKoPoYGaHqfGH6597wJHzZrl8su75eTntCxP/V/aM2b++8F3Qv20Vz NrN7p+++GgYN1MYTmATFgZ/J4UlvDBrWXCBzWVhcma5PZAEvN0akSMewNgA/bmfmJNc7 jUcKwLgkCSgzPBFu1LrTpnSH0twq1zBIUZhcr8owcJVsFTWzxnRuRPoE+b5fxY33kT9O aFRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:message-id:in-reply-to:references:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=MJnXMdit3nZo4IX2PgJfiVDx0wgidIDVebfIhz4u6FU=; b=iwU+C9EoZk01drosH4SojphNewrAlOxM+iEiuujUrR7TEOpd3MYHzo80cQvHlGpPZl tv0lM8AwzBISbLN+usMJWqw1e7CPiSwVbbkSoawcenYsVHOey9l5azaoVBXEdXs3cOv7 JqLpGE1xW/ZQhaWzw0E1o158qTxUXQIfVVY/WnFw6J+vH0LBtwOQbc5T7JVos87ecDj6 VgCiKdpb13itDtKjSEQXy1Ks1eOhwDt2QHosv+NWtRGM4e8FjTnu+nk5mux+rSQ4CXOq P9p3nRTHH8nHHr1NCTZq+rcfnXx8dK3Lf0WCInrHKbenLN9xwnhYlfeiCxmh3TXkWj0W RFeA== X-Gm-Message-State: AOAM5333ICLlM1IHvABT8aaTvYa+9IyBFkRzfwQ385RQWRWtbAk7AjYr WrmbbYJE3OqxbXZ+zD/oKqLyJ2jHAj69tQ== X-Received: by 2002:a17:90b:1651:b0:1dc:aec3:c17 with SMTP id il17-20020a17090b165100b001dcaec30c17mr11731288pjb.43.1651978884733; Sat, 07 May 2022 20:01:24 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id t27-20020a056a00139b00b0050dc76281a5sm5876232pfg.127.2022.05.07.20.01.24 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 07 May 2022 20:01:24 -0700 (PDT) From: softworkz X-Google-Original-From: softworkz Message-Id: In-Reply-To: References: Date: Sun, 08 May 2022 03:01:12 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v3 01/11] libavformat/asf: fix handling of byte array length values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Michael Niedermayer , softworkz Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: Yx2FZLbUC8lr From: softworkz The spec allows attachment sizes of up to UINT32_MAX while we can handle only sizes up to INT32_MAX (in downstream code) The debug.assert in get_tag didn't really address this, and truncating the value_len in calling methods cannot be used because the length value is required in order to continue parsing. This adds a check with log message in ff_asf_handle_byte_array to handle those (rare) cases. Signed-off-by: softworkz --- libavformat/asf.c | 8 +++++++- libavformat/asf.h | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/asf.c b/libavformat/asf.c index 1ac8b5f078..650f55ac3d 100644 --- a/libavformat/asf.c +++ b/libavformat/asf.c @@ -267,12 +267,18 @@ static int get_id3_tag(AVFormatContext *s, int len) } int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, - int val_len) + uint32_t val_len) { + if (val_len > INT32_MAX) { + av_log(s, AV_LOG_VERBOSE, "Unable to handle byte arrays > INT32_MAX in tag %s.\n", name); + return 1; + } + if (!strcmp(name, "WM/Picture")) // handle cover art return asf_read_picture(s, val_len); else if (!strcmp(name, "ID3")) // handle ID3 tag return get_id3_tag(s, val_len); + av_log(s, AV_LOG_DEBUG, "Unsupported byte array in tag %s.\n", name); return 1; } diff --git a/libavformat/asf.h b/libavformat/asf.h index 01cc4f7a46..4d28560f56 100644 --- a/libavformat/asf.h +++ b/libavformat/asf.h @@ -111,7 +111,7 @@ extern const AVMetadataConv ff_asf_metadata_conv[]; * is unsupported by this function and 0 otherwise. */ int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, - int val_len); + uint32_t val_len); #define ASF_PACKET_FLAG_ERROR_CORRECTION_PRESENT 0x80 //1000 0000