From patchwork Sun May 8 03:01:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Karmani X-Patchwork-Id: 35689 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:a885:b0:7f:4be2:bd17 with SMTP id ca5csp2386903pzb; Sat, 7 May 2022 20:01:53 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyHke30fVdVk6wR0wlsrZWNMh628puZH3N8rc/ro/xnguXZzgDPxjU6LccVEnzQ7qWIvKIO X-Received: by 2002:a17:907:4c8:b0:6f3:beac:260c with SMTP id vz8-20020a17090704c800b006f3beac260cmr9197847ejb.321.1651978913620; Sat, 07 May 2022 20:01:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651978913; cv=none; d=google.com; s=arc-20160816; b=Zwr4MWXabAqpLsQlzQqh9ZkyoEG9L9sy2LoLEFcmhfNw2d63ZKw+ln8CaQHUppSuiM CAoLat1/wEwXpb0iphWo/fxyyBaQ/2BetCu5OBXegHcUyvkLebInr0sbukzsGhU6o4Tw WUuXvKUDqdNSTo5GrpmBdyjdMhxnKe538injAh4b+PAsmFpwmQPsENyte2o5eM1bglnz BalsxOQ68ocZO/S2uOsjuxGlgnPbALQFDtNpKwDQlQAQQNS0K5RbW0WKphY8YVLoX5iN RWg8n/B69IIpfPeOx757X0fuYup0DMIQyRBshJ/bQwr+GbP4ULR0im92Oig3CskWrS4m qFnA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:to:mime-version:fcc:date:references :in-reply-to:message-id:from:dkim-signature:delivered-to; bh=diTDIugOQ12HUZmy2U9HiP0bkDbTJLJzVqFddn/dpmw=; b=oWLujI4M5sHAu4oSDAJ2ocMrDq6ZKIUMshtnGUGWBswQB8rPZNoMiJCSzYFjMedIZJ M/4/jZT9bJnj28KFvSXjks9uXR4EjwJ7Mr0HvtEqESI+9p0uCa6EnQAX31M7fzkvXYWz b5o6pvuMBARV3D9/1W3NiOzHZX4zZwYOVK0aqOb/AN2wd9OFv3pyvkRV5rq+I6Gwmq00 bMKG6lKHly3xhRwzT/w9zcR5kd3/r2a6p9RNIp7cwZm5UljkqcIAauhVovl+cvDnogkJ CkjdaEQQcnRw1GiR0PVOmd2JgCU9fppwk16fAaWuJWlKufiJbyPslNWlcw7syi9qZeLK kMfQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=gMkRfgRT; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id h5-20020aa7cdc5000000b00425b6b8e8afsi8046322edw.399.2022.05.07.20.01.53; Sat, 07 May 2022 20:01:53 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=gMkRfgRT; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 7B35C68B3C5; Sun, 8 May 2022 06:01:34 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6868A68B3A5 for ; Sun, 8 May 2022 06:01:27 +0300 (EEST) Received: by mail-pf1-f174.google.com with SMTP id d25so9478240pfo.10 for ; Sat, 07 May 2022 20:01:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:message-id:in-reply-to:references:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=lE4gYMujECG5VhN0uuaJTkOnodOeA90pObCj59GgD0w=; b=gMkRfgRT+4lxKPPxvKxBqJ6TXUWOG5jW9huf8nDRTZQQohXT7DFkIv/HbfvqLTEzFW 283N7IWOAOd8mpSNfahlCTzQX/B35hhjHsT1Xam39LsYRCONe0Llxv8QKDCUw/ey/7mq lqYTqykxJryJKjWQi5237T0a8l/AoevymvRIfLVj8CR9wT1doGeKLqd8AJ3Gd3H3Wmwm Y7iyY3JxqgNSxE1mf0lwKCfzMXPbV6vOhAcXJAtaXWBHC4oiO+M/7eZpGjb/zfrtcPuj FBZIwCXcgHm6srBZ9gMbQ4ctMvRfnyBq9jW7v8LOsJN3K+tzyIeri/EchfA6eBN+oMwz jf8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:message-id:in-reply-to:references:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=lE4gYMujECG5VhN0uuaJTkOnodOeA90pObCj59GgD0w=; b=LvJPui6KDW4pmNxEPgRRG2RVTEyWRIw2naXXwA7fejhixgWHoHv9sY7x/Tmjtt81j3 9X83XEH8v1x+Wy3crlHRoNdw0npHz2moyh4lkKW8/hgG0VUTha21VFLkrEtZX8FFNNwl csqKKplVbEh3o+FEr2bNnoIpnTANWeTsIA+y1xBrsNGqffUY5QEnmu+og+Fv0aep9pVA ug8tuMbrm9PLhi5e5eeWzKg/Ey0Z/3eDTGdjINH6tghu0dmSIsY3s/ewW8Cgqlx789CS XYcLFx3HLtIEoZW908MBaM17wxRdzQeu3aWRgkjUjCVzOo8fwEOqoVsCzyoWMOKW5hdw jsPQ== X-Gm-Message-State: AOAM532rZK2pI/0qUWUwBjzGInHCUR+K0EG46wEZb/y4e+bwNKqELQOD bBjmovr3L93kPbpQDZGVnIqnZZ0+I41nQg== X-Received: by 2002:a63:8ac7:0:b0:3aa:fa62:5a28 with SMTP id y190-20020a638ac7000000b003aafa625a28mr8403264pgd.400.1651978885814; Sat, 07 May 2022 20:01:25 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id ot16-20020a17090b3b5000b001dc4d22c0a7sm6204331pjb.10.2022.05.07.20.01.25 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 07 May 2022 20:01:25 -0700 (PDT) From: softworkz X-Google-Original-From: softworkz Message-Id: In-Reply-To: References: Date: Sun, 08 May 2022 03:01:13 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v3 02/11] libavformat/asfdec: fix get_value return type and add checks for X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Michael Niedermayer , softworkz Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: hJrrH9KZtTep From: softworkz unsupported values get_value had a return type of int, which means that reading QWORDS (case 4) was broken due to truncation of the result from avio_rl64(). Signed-off-by: softworkz --- libavformat/asfdec_f.c | 57 +++++++++++++++++++++++++++++++----------- 1 file changed, 43 insertions(+), 14 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index a8f36ed286..0fa2bbf653 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -202,7 +202,7 @@ static int asf_probe(const AVProbeData *pd) /* size of type 2 (BOOL) is 32bit for "Extended Content Description Object" * but 16 bit for "Metadata Object" and "Metadata Library Object" */ -static int get_value(AVIOContext *pb, int type, int type2_size) +static uint64_t get_value(AVIOContext *pb, int type, int type2_size) { switch (type) { case ASF_BOOL: @@ -548,6 +548,8 @@ static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; + uint64_t dar_num = 0; + uint64_t dar_den = 0; int desc_count, i, ret; desc_count = avio_rl16(pb); @@ -567,14 +569,27 @@ static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size) /* My sample has that stream set to 0 maybe that mean the container. * ASF stream count starts at 1. I am using 0 to the container value * since it's unused. */ - if (!strcmp(name, "AspectRatioX")) - asf->dar[0].num = get_value(s->pb, value_type, 32); - else if (!strcmp(name, "AspectRatioY")) - asf->dar[0].den = get_value(s->pb, value_type, 32); + if (!strcmp(name, "AspectRatioX")) { + dar_num = get_value(s->pb, value_type, 32); + if (dar_num > INT64_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num); + return AVERROR(ENOTSUP); + } + } + else if (!strcmp(name, "AspectRatioY")) { + dar_den = get_value(s->pb, value_type, 32); + if (dar_den > INT64_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den); + return AVERROR(ENOTSUP); + } + } else get_tag(s, name, value_type, value_len, 32); } + if (dar_num && dar_den) + av_reduce(&asf->dar[0].num, &asf->dar[0].den, dar_num, dar_den, INT_MAX); + return 0; } @@ -602,6 +617,8 @@ static int asf_read_metadata(AVFormatContext *s, int64_t size) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; + uint64_t dar_num[128] = {0}; + uint64_t dar_den[128] = {0}; int n, stream_num, name_len_utf16, name_len_utf8, value_len; int ret, i; n = avio_rl16(pb); @@ -629,17 +646,29 @@ static int asf_read_metadata(AVFormatContext *s, int64_t size) av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n", i, stream_num, name_len_utf16, value_type, value_len, name); - if (!strcmp(name, "AspectRatioX")){ - int aspect_x = get_value(s->pb, value_type, 16); - if(stream_num < 128) - asf->dar[stream_num].num = aspect_x; - } else if(!strcmp(name, "AspectRatioY")){ - int aspect_y = get_value(s->pb, value_type, 16); - if(stream_num < 128) - asf->dar[stream_num].den = aspect_y; - } else { + if (!strcmp(name, "AspectRatioX") && stream_num < 128) { + dar_num[stream_num] = get_value(s->pb, value_type, 16); + if (dar_num[stream_num] > INT64_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num[stream_num]); + return AVERROR(ENOTSUP); + } + } + else if (!strcmp(name, "AspectRatioY") && stream_num < 128) { + dar_den[stream_num] = get_value(s->pb, value_type, 16); + if (dar_den[stream_num] > INT64_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den[stream_num]); + return AVERROR(ENOTSUP); + } + } else get_tag(s, name, value_type, value_len, 16); + + + if (stream_num < 128 && dar_num[stream_num] && dar_den[stream_num]) { + av_reduce(&asf->dar[stream_num].num, &asf->dar[stream_num].den, dar_num[stream_num], dar_den[stream_num], INT_MAX); + dar_num[stream_num] = 0; + dar_den[stream_num] = 0; } + av_freep(&name); }