[FFmpeg-devel] [PATCH] avcodec/hevcdec: do not let updated extradata corrupt state

[Michael Niedermayer]

On Wed, Jul 05, 2017 at 04:39:05PM +0200, wm4 wrote:
> On Wed, 5 Jul 2017 16:08:38 +0200
> Michael Niedermayer <michael at niedermayer.cc> wrote:
> 
> > On Wed, Jul 05, 2017 at 09:56:10AM +0200, wm4 wrote:
> > > On Tue,  4 Jul 2017 22:33:52 +0200
> > > Michael Niedermayer <michael at niedermayer.cc> wrote:
> > >   
> > > > Fixes: out of array access
> > > > Fixes: 2451/clusterfuzz-testcase-minimized-4781613957251072
> > > > 
> > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > > ---
> > > >  libavcodec/hevcdec.c | 8 ++++----
> > > >  1 file changed, 4 insertions(+), 4 deletions(-)
> > > > 
> > > > diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
> > > > index cc8ac82164..55f51211c3 100644
> > > > --- a/libavcodec/hevcdec.c
> > > > +++ b/libavcodec/hevcdec.c
> > > > @@ -3057,7 +3057,7 @@ static int verify_md5(HEVCContext *s, AVFrame *frame)
> > > >      return 0;
> > > >  }
> > > >  
> > > > -static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length)
> > > > +static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length, int first)
> > > >  {
> > > >      int ret, i;
> > > >  
> > > > @@ -3069,7 +3069,7 @@ static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length)
> > > >  
> > > >      /* export stream parameters from the first SPS */
> > > >      for (i = 0; i < FF_ARRAY_ELEMS(s->ps.sps_list); i++) {
> > > > -        if (s->ps.sps_list[i]) {
> > > > +        if (first && s->ps.sps_list[i]) {
> > > >              const HEVCSPS *sps = (const HEVCSPS*)s->ps.sps_list[i]->data;
> > > >              export_stream_params(s->avctx, &s->ps, sps);
> > > >              break;
> > > > @@ -3099,7 +3099,7 @@ static int hevc_decode_frame(AVCodecContext *avctx, void *data, int *got_output,
> > > >      new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA,
> > > >                                              &new_extradata_size);
> > > >      if (new_extradata && new_extradata_size > 0) {
> > > > -        ret = hevc_decode_extradata(s, new_extradata, new_extradata_size);
> > > > +        ret = hevc_decode_extradata(s, new_extradata, new_extradata_size, 0);
> > > >          if (ret < 0)
> > > >              return ret;
> > > >      }
> > > > @@ -3387,7 +3387,7 @@ static av_cold int hevc_decode_init(AVCodecContext *avctx)
> > > >          s->threads_number = 1;
> > > >  
> > > >      if (avctx->extradata_size > 0 && avctx->extradata) {
> > > > -        ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size);
> > > > +        ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size, 1);
> > > >          if (ret < 0) {
> > > >              hevc_decode_free(avctx);
> > > >              return ret;  
> > > 
> > > Couldn't that have done in a less confusing way? What the heck does
> > > "first" even mean? (Also you have to look up what that means on the
> > > caller site.)
> > > 
> > > Can you explain this?  
> > 
> > first means "Preceding all others of a series or kind;" https://en.wiktionary.org/wiki/first
> 
> Thanks for the English lesson. By the way, you're the only person on
> the internet who uses "iam".
> 

> > in the context of hevc_decode_extradata(), a function decoding extradata
> > that signifies the first of a series of extradata.
> > 
> > No question it can be done differently, everything can be done
> > differently.
> 
> So can you explain why "first" is checked every loop, instead of
> putting the loop into an if, or

Every piece of code can be implemented im many ways.
Theres many equivalent and near equivalent ways to do it.
add a if(), add a condition to a existing if(), ...
some of these are a bit simpler, some are a bit faster, speedwise
theres nothing one can gain here as this executes too rarely


> (what should have been done) moving the
> entire loop out of the function and putting it inline into the only
> place where it's effectively used?

For a security fix i like to make sure it can be robustly backported.
If i add a "int first" the compiler makes sure that every call has
the parameter set.
If i move code around the compiler wouldnt notice if there was another
call.

For git master, i agree moving the code is slightly nicer, ill post a
patch to make that change

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The bravest are surely those who have the clearest vision
of what is before them, glory and danger alike, and yet
notwithstanding go out to meet it. -- Thucydides
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170706/605c447f/attachment.sig>