From patchwork Tue Jan 11 06:38:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: XiaoYang X-Patchwork-Id: 33200 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a6b:cd86:0:0:0:0:0 with SMTP id d128csp3418324iog; Mon, 10 Jan 2022 22:39:12 -0800 (PST) X-Google-Smtp-Source: ABdhPJz1ZM62A+LQqZpG1BWSXY+qhk1G5O02rob+eO848sS+/OG7tqmhVat8pZ6LVZJSRGf8Ej2o X-Received: by 2002:aa7:de86:: with SMTP id j6mr2961194edv.1.1641883152209; Mon, 10 Jan 2022 22:39:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1641883152; cv=none; d=google.com; s=arc-20160816; b=rgrTF1aGJwdMg2K2lRyLBYdqm5lC04l0Ort8ouq/ftchPRQhXKvB7sfCjfHSCe9sd7 yACdk2dmx2N/mCSlfIlBgQetEilZN4Wgd68QgFt+CgFp8JAhkodzW0i0mOGlKO+F7JzH Q137pvqP/iXhkF2x8DgLYub+2PqBxRDGpU2geRuIqVe4wJhG5xjZDgXApEG09kVvVg1x UBnHmewGDTdWlg34CDmcvdPIP7V6TQouIXL5nXSygc4FEMj+8tTuR+Knn8woCfoUcY38 WTv+7SNr94K5N9awHEiMLxdnFxymBit2VvARAaufmj1KPTsj6t80jGCpUiS+Cq/fwcaZ jICg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:mime-version:message-id:date:to:from :dkim-signature:delivered-to; bh=QXep7idf8XJASVRpNzl2D/ns4xOB8OAP+r3yR66Ia4c=; b=uRtpnO99/43Pk7+9fWOkeNxhrFayewiBVD9wsojD5Ev3tInan/c6LPJNpUEwhMkDnF n8tGjlh/MyZxXT5i7rVvs6C+pJiHiy+f5Ls1lriNM2m3TUHo/TmuEA5wZRwvsHDgqIkx QyYFiPKvXlFS2IPb8zrHoD5j+tfU/NsQXAz8kITX686gRGoiJFb7rNVlDeuenT1zycIg 45PE3+EZ5o/1ArlGQON1pvhSOXdK8f00I/p1tDAx+uINSzNkA7iRD3XOkKGT4RKLEDRj 1NVzllygrO9XtZg9gxxiOpXTlEIdtkvlQ0wi72bsSyz3O9LEGqA60XY4BRqn/lE0nHrz Wqpw== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@163.com header.s=s110527 header.b=DdmbaPga; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=163.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id hw17si4880421ejc.800.2022.01.10.22.39.11; Mon, 10 Jan 2022 22:39:12 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@163.com header.s=s110527 header.b=DdmbaPga; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id D9D1D68AEBA; Tue, 11 Jan 2022 08:39:07 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from m12-14.163.com (m12-14.163.com [220.181.12.14]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id EF20568A6F6 for ; Tue, 11 Jan 2022 08:38:59 +0200 (EET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=gJeJS dNq2FjHfQtGXGjluMkL7dr8qEjBi45ZzMvUKF4=; b=DdmbaPgaMwG1JjkpFMMBu 1i1hnIp4oQTaypvEHyul+zyoYMAx1l66VBrCB9KftcN8ilqO38azBaVZH8LyLHwR K6Zg8tLMNHb/U5aY1sdMjOGpc1Le7Ixu6AH5ZKHFA3u9VEr+CK5LSGNgmLq2eUCl momqz9Ed1UOepdzH/PTmj0= Received: from localhost.localdomain (unknown [103.107.216.227]) by smtp10 (Coremail) with SMTP id DsCowAB3S8oBJt1hXURWHQ--.12415S2; Tue, 11 Jan 2022 14:38:58 +0800 (CST) From: Yang Xiao To: ffmpeg-devel@ffmpeg.org Date: Tue, 11 Jan 2022 14:38:56 +0800 Message-Id: <20220111063856.15699-1-yshaw1999@163.com> X-Mailer: git-send-email 2.30.1 (Apple Git-130) MIME-Version: 1.0 X-CM-TRANSID: DsCowAB3S8oBJt1hXURWHQ--.12415S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7AF18GryUtF1UurWkXF48Xrb_yoW8XFyfp3 9FvF1Ikr1rXayYvrnrtayvqr1xJr1kK34S9w48Z3Wa93s5urn8Xr90gFWFkr1DWry8XFy8 Zrn5Z3WUWr1DWFJanT9S1TB71UUUUbUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jrmRUUUUUU= X-Originating-IP: [103.107.216.227] X-CM-SenderInfo: 51vkt4irzzmqqrwthudrp/xtbBlxSF7FSIl-aymwABs- Subject: [FFmpeg-devel] [PATCH] avformat/asfdec: fix crash caused by free wlid pointers X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Yang Xiao , yshaw1999@163.com Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: GADwJ6JAaIB8 From: Yang Xiao This commit fixed a crash when seeking wma frames, asf decoder will try to demux in function asf_read_pts(). Pointer member side_data of AVPacket that allocated by stack may be wild pointer. Prevent releasing wild pointers in AVPacket when some functions try to call av_packet_unref, example av_read_frame(). --- libavformat/asfdec_f.c | 2 +- libavformat/mpc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index a8f36ed286..bae0ecfc7c 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -1433,7 +1433,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index, { FFFormatContext *const si = ffformatcontext(s); ASFContext *asf = s->priv_data; - AVPacket pkt1, *pkt = &pkt1; + AVPacket pkt1 = {0}, *pkt = &pkt1; ASFStream *asf_st; int64_t pts; int64_t pos = *ppos; diff --git a/libavformat/mpc.c b/libavformat/mpc.c index b5b2bab33c..ad0d693152 100644 --- a/libavformat/mpc.c +++ b/libavformat/mpc.c @@ -189,7 +189,7 @@ static int mpc_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp AVStream *st = s->streams[stream_index]; FFStream *const sti = ffstream(st); MPCContext *c = s->priv_data; - AVPacket pkt1, *pkt = &pkt1; + AVPacket pkt1 = {0}, *pkt = &pkt1; int ret; int index = av_index_search_timestamp(st, FFMAX(timestamp - DELAY_FRAMES, 0), flags); uint32_t lastframe;