[FFmpeg-devel] [PATCH] lavc/golomb: Fix UE golomb overwrite issue.

[Michael Niedermayer]

On Wed, May 31, 2017 at 09:01:47AM +0800, Jun Zhao wrote:
> 
> 
> On 2017/5/29 7:40, Michael Niedermayer wrote:
> > On Fri, May 26, 2017 at 09:19:09AM +0800, Jun Zhao wrote:
> >>  golomb.h |    5 ++++-
> >>  1 file changed, 4 insertions(+), 1 deletion(-)
> >> 228c7180856b65d095dd0b8d59f3d3ff4f65774a  0001-lavc-golomb-Fix-UE-golomb-overwrite-issue.patch
> >> From eabcbf3d41e83f24623e6195d4a0ff86e4d95a80 Mon Sep 17 00:00:00 2001
> >> From: Jun Zhao <jun.zhao at intel.com>
> >> Date: Fri, 26 May 2017 09:02:29 +0800
> >> Subject: [PATCH] lavc/golomb: Fix UE golomb overwrite issue.
> >>
> >> put_bits just support write up to 31 bits, when write 32 bit in
> >> put_bits, it's will overwrite the bit buffer, because the default
> >> assert level is 0, the av_assert2(n <= 31 && value < (1U << n))
> >> in put_bits can not be trigger runtime.
> >>
> >> Signed-off-by: Jun Zhao <jun.zhao at intel.com>
> >> ---
> >>  libavcodec/golomb.h | 5 ++++-
> >>  1 file changed, 4 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h
> >> index 0833aff468..2c5a969ac1 100644
> >> --- a/libavcodec/golomb.h
> >> +++ b/libavcodec/golomb.h
> >> @@ -468,7 +468,10 @@ static inline void set_ue_golomb(PutBitContext *pb, int i)
> >>          put_bits(pb, ff_ue_golomb_len[i], i + 1);
> >>      else {
> >>          int e = av_log2(i + 1);
> >> -        put_bits(pb, 2 * e + 1, i + 1);
> >> +        if (e < 16)
> >> +            put_bits(pb, 2 * e + 1, i + 1);
> >> +        else
> >> +            put_bits32(pb, i + 1);
> > 
> > this is wrong
> > 
> > if e is 16 or larger the length is 33 bits or longer its never
> > 32
> > 
> 
> Yes, this is a wrong fix, how about add set_ue_golomb_long()/ set_ue_golomb_64() for this case ? 

yes, thats probably a good idea

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The misfortune of the wise is better than the prosperity of the fool.
-- Epicurus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170602/4ba174d1/attachment.sig>