From patchwork Thu Jul 27 07:31:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steven Liu X-Patchwork-Id: 43004 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:c11c:b0:130:ccc6:6c4b with SMTP id bh28csp247207pzb; Thu, 27 Jul 2023 00:32:03 -0700 (PDT) X-Google-Smtp-Source: APBJJlH3C3qfa0c1qm2L2D8+173rzxOJPLT72lkNECA1U8t8rKfVp6p5FEU1xhz1pcX3uVBSCLuP X-Received: by 2002:a17:906:20d0:b0:988:b61e:4219 with SMTP id c16-20020a17090620d000b00988b61e4219mr1402725ejc.29.1690443123197; Thu, 27 Jul 2023 00:32:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1690443123; cv=none; d=google.com; s=arc-20160816; b=jZlGJppgljyHCwfTuP4P8f43R/2c/7TmUOoQld1fyc/cu79/GKra0dCjzIEt3rEqRa X0TJ0fhZmc1Vp5T9teBTU2Vpn1uiHVhhXp9atBxoe8bciwnkLUga6608xu4BSNv4mJwv 87NiC8arTtj6ESrEmRUrZOW0LJ7Z100y4aw4XUdH8l2xeJ94SaoeOOzf5onF39PjvcvP xUCV8ah+TDWKTJ4YdV05oNMqaW2A0pz1rlXJXw6VOBBw7PzCWlxEGtvWJugQ4KjPjHSm pLgA9fUyQB/I18hgAPmAQg3GIb0zCPazAiN8W/SgzBXpRC7Qic5ksOqsTODK90RIh5rc otOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:feedback-id:mime-version:references :in-reply-to:message-id:date:to:from:delivered-to; bh=GsdE+tP60qyaWWhxppAf9ijOEd4ciRV+DsPIbVxOQzc=; fh=UbKzVxiKqWMRVKHrgyn1mg7tw/nuokz5Lr8G3ZXebqo=; b=RqAASjlEHfIb3p5Cqm7Z/iFasQQqbFRMrw8mj0CGa7Kds6YwOAYltnUxNcRgOC0m6I iICjFs22fdQY2rXz9lwsDtwAvlDzU+GOawUDoEU3bGDnCG4Qu6XJ4hL1ykJoc4HDYcSE LlHZBv/IQ2o3eg/waRpo18G75ctTooPTRxzXb3F7b5UwrNdydFWcGXaWhercG/+JmCOt /f6lOliwn/ib9r07MyEI4cqbAIxseQaaZCHHluCHH43zTB6LjTga3ReZPqlSuXu5Jz6h WxjDVEvJhj0av5Mf7aM52EtDYc42QjwAW/GUJAwF/LOPgi4sXKO4M6xGUITPUb9k6pC1 qUzA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id kk20-20020a170907767400b0098935e138basi561311ejc.286.2023.07.27.00.32.02; Thu, 27 Jul 2023 00:32:03 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 2DE5D68C9EF; Thu, 27 Jul 2023 10:31:59 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from bg4.exmail.qq.com (bg4.exmail.qq.com [43.154.54.12]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 63C0368C9BF for ; Thu, 27 Jul 2023 10:31:51 +0300 (EEST) X-QQ-mid: bizesmtp76t1690443105tm9aew9d Received: from localhost ( [103.102.203.196]) by bizesmtp.qq.com (ESMTP) with id ; Thu, 27 Jul 2023 15:31:44 +0800 (CST) X-QQ-SSF: 01100000000000Z0Z000000A0000000 X-QQ-FEAT: 0vfWcIgh24y6ZUve1FYsByQ8Ti1gZ3WjXpcjneIi6hiU/Klf5sqhd1mpsX1e1 UmSxt1QX3xWhYZ63aQearyuk+VluLu3McNpnCa30wrq9SdunsbFle93Ju6Rlw7tTfF8rzsh dl1+bqfDrICX1QoUwICF5j8GJjTUjFp4+EdXh68cjb1PhM2wzckE0IM8GZaT8nDyCe9N0cP GAuGCliBKc5xDbpSAo0aIjfycuOth4j0IBeRdKQz/cvzsKExaEF1hx7CrjqM0hPCtIDEBw3 W7Ir0mUy7ckS/83tQcRavLKxHdfhMvvpB/l5d5f82dBy6E6IfRR5BvQtTm41gsHQp7KkZhy l6GsnIOLo5iYxdUnygd6idRJtkH3EmGQV3RmfzHtBxYVkXegiQ= X-QQ-GoodBg: 0 X-BIZMAIL-ID: 10649776815798364184 From: Steven Liu To: ffmpeg-devel@ffmpeg.org Date: Thu, 27 Jul 2023 15:31:42 +0800 Message-Id: <20230727073142.64813-1-lq@chinaffmpeg.org> X-Mailer: git-send-email 2.40.0 In-Reply-To: References: MIME-Version: 1.0 X-QQ-SENDSIZE: 520 Feedback-ID: bizesmtp:chinaffmpeg.org:qybglogicsvrsz:qybglogicsvrsz3a-0 Subject: [FFmpeg-devel] [PATCH v2] avformat/flvdec: use avio operation instead of pb->buf_ptr use X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Steven Liu Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: MDF6AoQ91e+B check ensure seekback 4 bytes before read 4 bytes from pb, and seek back 4 byte from current position after read 4 bytes. fix segfaults: READ of size 1 at 0x6100000003b7 thread T0 #0 0x7f928d in flv_same_video_codec ffmpeg/libavformat/flvdec.c:317:29 #1 0x7f928d in flv_read_packet ffmpeg/libavformat/flvdec.c:1177 #2 0x6ff32f in ff_read_packet ffmpeg/libavformat/demux.c:575:15 #3 0x70a2fd in read_frame_internal ffmpeg/libavformat/demux.c:1263:15 #4 0x71d158 in avformat_find_stream_info ffmpeg/libavformat/demux.c:2634:15 #5 0x4c821b in LLVMFuzzerTestOneInput ffmpeg/tools/target_dem_fuzzer.c:206:11 Signed-off-by: Steven Liu --- libavformat/flvdec.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 3fe21622f7..38f34567dd 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -35,6 +35,7 @@ #include "libavutil/intreadwrite.h" #include "libavutil/mathematics.h" #include "avformat.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" #include "flv.h" @@ -313,8 +314,14 @@ static int flv_same_video_codec(AVFormatContext *s, AVCodecParameters *vpar, int return 1; if (flv->exheader) { - uint8_t *codec_id_str = (uint8_t *)s->pb->buf_ptr; - uint32_t codec_id = codec_id_str[3] | codec_id_str[2] << 8 | codec_id_str[1] << 16 | codec_id_str[0] << 24; + uint32_t codec_id = 0; + int ret = ffio_ensure_seekback(s->pb, 4); + if (ret < 0) { + av_log(s, AV_LOG_WARNING, "Could not ensure seekback, because %s", av_err2str(ret)); + return 0; + } + codec_id = avio_rb32(s->pb); + avio_seek(s->pb, -4, SEEK_CUR); switch(codec_id) { case MKBETAG('h', 'v', 'c', '1'): return vpar->codec_id == AV_CODEC_ID_HEVC;