From patchwork Fri Sep 30 14:20:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aidan MacDonald X-Patchwork-Id: 38478 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:3b1c:b0:96:9ee8:5cfd with SMTP id c28csp1733552pzh; Fri, 30 Sep 2022 07:19:58 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5r/cQwoKVv7fFwDDVgPbxw51PJnInth6X6HPozeE6sh8DKw7YbhPDTlsTbm5KicJwNItKW X-Received: by 2002:a17:907:d07:b0:72e:ec79:ad0f with SMTP id gn7-20020a1709070d0700b0072eec79ad0fmr6728346ejc.296.1664547598098; Fri, 30 Sep 2022 07:19:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1664547598; cv=none; d=google.com; s=arc-20160816; b=K8h4B3ru6sTIne2wwB8HbdS4fnW0Xda4Fvs3W2tefF0sszkLBeLswaTA8s567th53T pPSmCEur7HdURQOHu2UQbYJ2wyGx7/dfW1xbahUxnW4g2nIqQAs1TAGxnUGdn9jrdvk0 5xlWw9duqyE/2W344YtrEjeYxlWlCMlFIap6ynEndlNeosefWySczYqq7kwp8Yyokv+G 9+QTWJkyksF/mvUKCBdCwCkwXpB6jOk3EZQBuItpmtourTB8X5rORHfvPuR+aUNbea6u lfBYsHcYSX7uQMXOTadYRy56M0Y05OMOnK3VGyarsSBNNPsOQG7IqC9lQUOADt4s0At2 euKw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:message-id:date:to:from :dkim-signature:delivered-to; bh=VxyqjxCdmXC7CybdNXxtAgCPW01wHigevA/Rt5juTh4=; b=nAnU4459gwshX2hvWE9wK0J04Og0oImKjEyGNw+FqqOfiPFzGGC9RriTIpPkj6E//9 Q7an0Fm3X+waMuUB9j+7wrG4Vq8v6iKd7cByASmL14M58K9F/Xn+deILG51RzQd3LHQJ wDP8ZgNBFogmqfkcP6yWH1YHh/GOVSDav/nExKPK/BHvR5+NEK2FLbey6TFoKXvpry59 42NeTtbMh9rDW7JcJJEDUajNdoDCqZafAdVXTrXg1Jcr+whKL6pIZ4pm9X1mZb/Pmw89 47YaXbLxSvQzAP7BQMPSHC6+AcE5seI9rqck9Uzi2mw7LB/f38omyVDRQ+0nBLamIbSu Wf6g== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=UmekP24x; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id r1-20020a50c001000000b0045527b7013bsi2036969edb.427.2022.09.30.07.19.57; Fri, 30 Sep 2022 07:19:58 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=UmekP24x; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 4D63A68BBB2; Fri, 30 Sep 2022 17:19:55 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 2CD3068B903 for ; Fri, 30 Sep 2022 17:19:49 +0300 (EEST) Received: by mail-wr1-f49.google.com with SMTP id s14so7127630wro.0 for ; Fri, 30 Sep 2022 07:19:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date; bh=f0DWgi1NSD0tlcnInnZoQe/A2/7zhdJgs2fTj2EMY9Y=; b=UmekP24xmj7U27fQlYC5d1VG0M84RYrkpcaKTN4CGR4EtzqB0XWMIhJBNav/uOJKKZ eWjGSl6RG0AM2ZL/M8xVGa4eTy3TtPn4nbOdFnGAhjZpRVRRww7qx/Sp8Urhy1/ZO00i v09g+Vo8MydNsOchrBbHH2ALZ+i9en1sYO6XMpPNSGN0tTWLXnKkfrP2ZZ6/GiEzwe04 VzhEYnGJbVHHg6A90On80CwlKnURj5GYkoFs6tk6nVvOVFrBRL3cXeJjA12W4oVd8+EV CQIB9mFoFYGhRdCv0aQolR5p4Z+aejI5rVJbwahiDdxshm0t10SdzfFs1+WscgFYxTR2 nw1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date; bh=f0DWgi1NSD0tlcnInnZoQe/A2/7zhdJgs2fTj2EMY9Y=; b=MBX3M/ySfhZdPFkv2mYf7SRaNfu7h5gq8DG3byepPVZef/XdUMZanLw5gbPiH0VNBQ W7OM4uQRdZNWXvCDZ+lbXNNHy8P1v3CcM23dt+HJ/jby31M5JOr7xOS5REXMDgacP5P+ +AP9CWX1o5mTzl+4gKNTSeKCH/l8clzz+1X1GWoMzU/KRkLJK114zpOKA23/vjlY7p3Z tOk1i/u9sRTdt26HnePQWC3t2H0RnzhD5lPtpulXrsRZBwzX/z200mWl4EW4Arsykgcp 8dujVO9JslfkU6LppYkisnjUqzlfXWFwch/5bi06Z6zswpqClT4rEGDihSJ/laoYW1pS RymQ== X-Gm-Message-State: ACrzQf0PZ1q0U3hM+LCNjtsPJFKmZarYY4kdepf5ncWWe3EDDGnaGfk0 7OwJciNkDDbjR1JPRRpay5EcblAHg+A= X-Received: by 2002:a05:6000:18aa:b0:22a:b61d:877a with SMTP id b10-20020a05600018aa00b0022ab61d877amr5991904wri.512.1664547588400; Fri, 30 Sep 2022 07:19:48 -0700 (PDT) Received: from localhost (92.40.170.30.threembb.co.uk. [92.40.170.30]) by smtp.gmail.com with ESMTPSA id z2-20020a05600c0a0200b003b48dac344esm7481054wmp.43.2022.09.30.07.19.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Sep 2022 07:19:47 -0700 (PDT) From: Aidan MacDonald To: ffmpeg-devel@ffmpeg.org Date: Fri, 30 Sep 2022 15:20:09 +0100 Message-Id: <20220930142009.5862-1-aidanmacdonald.0x0@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] avcodec/dvdsub_parser: Fix length check for short packets X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: 3f0i2aM1gH3I The DVD subtitle parser handles two types of packets: "normal" packets with a 16-bit length, and HD-DVD packets that set the 16-bit length to 0 and encode a 32-bit length in the next four bytes. This implies that HD-DVD packets are at least six bytes long, but the code didn't actually verify this. The faulty length check results in an out of bounds read for zero-length "normal" packets that occur in the input, which are only 2 bytes long, but get misinterpreted as an HD-DVD packet. When this happens the parser reads packet_len from beyond the end of the input buffer. The subtitle stream is not correctly decoded after this point due to the garbage packet_len. Fixing this is pretty simple: fix the length check so packets less than 6 bytes long will not be mistakenly parsed as HD-DVD packets. Signed-off-by: Aidan MacDonald --- libavcodec/dvdsub_parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/dvdsub_parser.c b/libavcodec/dvdsub_parser.c index 44738a73d6..8871b6a383 100644 --- a/libavcodec/dvdsub_parser.c +++ b/libavcodec/dvdsub_parser.c @@ -43,7 +43,7 @@ static int dvdsub_parse(AVCodecParserContext *s, *poutbuf_size = buf_size; if (pc->packet_index == 0) { - if (buf_size < 2 || AV_RB16(buf) && buf_size < 6) { + if (buf_size < 2 || (AV_RB16(buf) == 0 && buf_size < 6)) { if (buf_size) av_log(avctx, AV_LOG_DEBUG, "Parser input %d too small\n", buf_size); return buf_size;