[FFmpeg-devel] [PATCH] avformat/aviobuf: Delay buffer downsizing until asserts are met

[Michael Niedermayer]

On Sun, Jun 30, 2019 at 01:07:00PM +0000, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > On Mon, Jun 17, 2019 at 11:12:00PM +0000, Andreas Rheinhardt wrote:
> >> Michael Niedermayer:
> >>> Fixes: Assertion failure
> >>> Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
> >>>
> >>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> >>> ---
> >>>  libavformat/aviobuf.c | 3 +--
> >>>  1 file changed, 1 insertion(+), 2 deletions(-)
> >>>
> >>> diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
> >>> index 5a33f82950..6a5cd97b0a 100644
> >>> --- a/libavformat/aviobuf.c
> >>> +++ b/libavformat/aviobuf.c
> >>> @@ -570,7 +570,7 @@ static void fill_buffer(AVIOContext *s)
> >>>      }
> >>>  
> >>>      /* make buffer smaller in case it ended up large after probing */
> >>> -    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size) {
> >>> +    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size && len >= s->orig_buffer_size) {
> >>>          if (dst == s->buffer && s->buf_ptr != dst) {
> >>>              int ret = ffio_set_buf_size(s, s->orig_buffer_size);
> >>>              if (ret < 0)
> >>> @@ -578,7 +578,6 @@ static void fill_buffer(AVIOContext *s)
> >>>  
> >>>              s->checksum_ptr = dst = s->buffer;
> >>>          }
> >>> -        av_assert0(len >= s->orig_buffer_size);
> >>>          len = s->orig_buffer_size;
> >>>      }
> >>>  
> >>>
> >> I just noticed that ticket #7094 is about this assert. Could you test
> >> whether everything works fine with your fix applied (and then mention
> >> said this ticket in the commit message)?
> > 
> > The ticket does not contain a full testcase, just a code snippet,
> > and the person reporting the issue has not yet replied
> > I suggest we apply this fix with a "May fix Ticket7094"
> > 
> > 
> Agreed.

will apply

thanks

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Those who are best at talking, realize last or never when they are wrong.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20190630/4dfd9596/attachment.sig>