From patchwork Wed Oct 19 09:47:33 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jerome Martinez X-Patchwork-Id: 38824 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:4a86:b0:9d:28a3:170e with SMTP id fn6csp262993pzb; Wed, 19 Oct 2022 02:47:45 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7oEWDasqA5FB6zktJeQBrlCM2ORnTflMqreqU/M8bIum8WMYCZ+ja6ntTXYDEbFCnUK9O1 X-Received: by 2002:a17:907:8a24:b0:795:bb7d:643b with SMTP id sc36-20020a1709078a2400b00795bb7d643bmr76876ejc.115.1666172865744; Wed, 19 Oct 2022 02:47:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666172865; cv=none; d=google.com; s=arc-20160816; b=OkTe5wht/cBLzQLy/TdEOWpEyPoWvvhsUUfM0KYrAuz81jtq99XPXpHDrXu+Zp8X7E oWlZRZ76bZB+tu7jzwtYfx6ZPCZvABftybV8RBU1oXGnFHegBYm7c8uGAtzwC82YxS+u P9M5JLN9sZTK5fTGpgrdeed80LrFCdTfhjcbXiga8EdfrlCSa+Z9QHxWmEoHzsOOQZaO F1kU3AOQnY7kIOU67EqcUsFfbzeRJTdvHZCisFhf9Kf0vmgK4k9hcmD8tqPj+goQiQXX Xvi3Pz2PqEhM2XNTuXUMlmyxh38eRuGqWD7hUWVgsOxgZN0WNM6BWEI8Fxqm2GRU5gct oeEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:from:to:content-language:user-agent:mime-version :date:message-id:delivered-to; bh=3OGyMeATjCgryQq4EoN4Zdd4Le0BpDwQu+ZqMEbPLMo=; b=txMI6SiyjkgHoEdJnJP6l4xjJQGkTA3FOoC5wEySXSMPAYmJr2ihjfGdr4RQ40uI+s X9NiW3ZMMu8uQwrReAV1JhaM8be57pIHFvDvZk1JrzmnTK67ReYIe/m9K83vE3jg+S5b Nq+ECOcxE1kfn3N7pjw6ScUHSAN63K3gkOspgUIUyywvXfIrkwxpJg0nFseZNURmi0tS QRJ5k7FINzmk0xMRz/29k/oIMo8ghOj98IXSbLJaS01O/0HxriTUkCck4d4JXF6mGBlN cLVHqdZ9bVBnNIaDxmpu2HqtXvusbWTnpQuTyoP9XzlljEQGAa+w71gpX4wbLxF+TIg9 Gs8w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=mediaarea.net Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id hv20-20020a17090760d400b00791a67e4c00si1557473ejc.835.2022.10.19.02.47.44; Wed, 19 Oct 2022 02:47:45 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=mediaarea.net Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id CCC0A68BE0F; Wed, 19 Oct 2022 12:47:41 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from 19.mo561.mail-out.ovh.net (19.mo561.mail-out.ovh.net [178.32.98.231]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6798368BDF5 for ; Wed, 19 Oct 2022 12:47:35 +0300 (EEST) Received: from player714.ha.ovh.net (unknown [10.108.20.202]) by mo561.mail-out.ovh.net (Postfix) with ESMTP id A5A5927B96 for ; Wed, 19 Oct 2022 09:47:34 +0000 (UTC) Received: from mediaarea.net (p548f9776.dip0.t-ipconnect.de [84.143.151.118]) (Authenticated sender: jerome@mediaarea.net) by player714.ha.ovh.net (Postfix) with ESMTPSA id 2EAFE2FCF8CB1 for ; Wed, 19 Oct 2022 09:47:34 +0000 (UTC) Authentication-Results: garm.ovh; auth=pass (GARM-102R0044f918fc8-8410-4beb-94e3-777fa5ed426d, 6BDC46C680EBB59C9528D672C1DFEBB298776169) smtp.auth=jerome@mediaarea.net X-OVh-ClientIp: 84.143.151.118 Message-ID: Date: Wed, 19 Oct 2022 11:47:33 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.3.3 Content-Language: en-US To: FFmpeg development discussions and patches From: Jerome Martinez X-Ovh-Tracer-Id: 14390689663538792697 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedvfedrfeelgedgvddtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecuhedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhepkfffgggfvffhufgtgfesthekredttdefjeenucfhrhhomheplfgvrhhomhgvucforghrthhinhgviicuoehjvghrohhmvgesmhgvughirggrrhgvrgdrnhgvtheqnecuggftrfgrthhtvghrnhepkedvfeeljeehleeikeettefhffeljefgvdegvdekgeelgfeiveeiteeuvdduvdffnecukfhppeduvdejrddtrddtrddupdekgedrudegfedrudehuddruddukeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeduvdejrddtrddtrddupdhmrghilhhfrhhomhepoehjvghrohhmvgesmhgvughirggrrhgvrgdrnhgvtheqpdhnsggprhgtphhtthhopedupdhrtghpthhtohepfhhfmhhpvghgqdguvghvvghlsehffhhmphgvghdrohhrghdpoffvtefjohhsthepmhhoheeiuddpmhhouggvpehsmhhtphhouhht Subject: [FFmpeg-devel] [PATCH] avcodec/dpx: fix check of minimal data size for unpadded content X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: NDdHTSX+ijCo stride value is not relevant with unpadded content and the total count of pixels (width x height) must be used instead of the rounding based on width only then multiplied by height unpadded_10bit value computing is moved sooner in the code in order to be able to use it during computing of minimal content size Fix 'Overread buffer' error when the content is not lucky enough to have (enough) padding bytes at the end for not being rejected by the formula based on the stride value Signed-off-by: Jerome Martinez ---  libavcodec/dpx.c | 34 ++++++++++++++++++----------------  1 file changed, 18 insertions(+), 16 deletions(-)              av_log(avctx, AV_LOG_ERROR, "Overread buffer. Invalid header?\n");              return AVERROR_INVALIDDATA;          } else { @@ -609,20 +625,6 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p,      if ((ret = ff_get_buffer(avctx, p, 0)) < 0)          return ret; -    av_strlcpy(creator, avpkt->data + 160, 100); -    creator[100] = '\0'; -    av_dict_set(&p->metadata, "Creator", creator, 0); - -    av_strlcpy(input_device, avpkt->data + 1556, 32); -    input_device[32] = '\0'; -    av_dict_set(&p->metadata, "Input Device", input_device, 0); - -    // Some devices do not pad 10bit samples to whole 32bit words per row -    if (!memcmp(input_device, "Scanity", 7) || -        !memcmp(creator, "Lasergraphics Inc.", 18)) { -        unpadded_10bit = 1; -    } -      // Move pointer to offset from start of file      buf =  avpkt->data + offset; diff --git a/libavcodec/dpx.c b/libavcodec/dpx.c index 4f50608..d4699f6 100644 --- a/libavcodec/dpx.c +++ b/libavcodec/dpx.c @@ -476,14 +476,30 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p,          avctx->colorspace = AVCOL_SPC_RGB;      } +    av_strlcpy(creator, avpkt->data + 160, 100); +    creator[100] = '\0'; +    av_dict_set(&p->metadata, "Creator", creator, 0); + +    av_strlcpy(input_device, avpkt->data + 1556, 32); +    input_device[32] = '\0'; +    av_dict_set(&p->metadata, "Input Device", input_device, 0); + +    // Some devices do not pad 10bit samples to whole 32bit words per row +    if (!memcmp(input_device, "Scanity", 7) || +        !memcmp(creator, "Lasergraphics Inc.", 18)) { +        unpadded_10bit = 1; +    } +      // Table 3c: Runs will always break at scan line boundaries. Packing      // will always break to the next 32-bit word at scan-line boundaries.      // Unfortunately, the encoder produced invalid files, so attempt      // to detect it +    // Also handle special case with unpadded content      need_align = FFALIGN(stride, 4); -    if (need_align*avctx->height + (int64_t)offset > avpkt->size) { +    if (need_align*avctx->height + (int64_t)offset > avpkt->size && +        (!unpadded_10bit || (avctx->width * avctx->height * elements + 2) / 3 * 4 + (int64_t)offset > avpkt->size)) {          // Alignment seems unappliable, try without -        if (stride*avctx->height + (int64_t)offset > avpkt->size) { +        if (stride*avctx->height + (int64_t)offset > avpkt->size || unpadded_10bit) {