[FFmpeg-devel] [PATCH 4/6] avformat/flvdec: Check for nesting depth in amf_parse_object()

[Michael Niedermayer]

On Tue, Jan 26, 2021 at 04:37:38PM +0100, Anton Khirnov wrote:
> Quoting Michael Niedermayer (2021-01-25 21:29:21)
> > On Sun, Jan 24, 2021 at 02:14:43PM +0100, Anton Khirnov wrote:
> > > Quoting Michael Niedermayer (2021-01-23 23:10:54)
> > > > Fixes: out of array access
> > > > Fixes: 29202/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5112845840809984
> > > > 
> > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > > ---
> > > >  libavformat/flvdec.c | 5 +++++
> > > >  1 file changed, 5 insertions(+)
> > > > 
> > > > diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
> > > > index 07ef342278..e15be0a221 100644
> > > > --- a/libavformat/flvdec.c
> > > > +++ b/libavformat/flvdec.c
> > > > @@ -41,6 +41,8 @@
> > > >  
> > > >  #define RESYNC_BUFFER_SIZE (1<<20)
> > > >  
> > > > +#define MAX_DEPTH 10
> > > 
> > > Why 10 specifically.
> > 
> > 10 is arbitrary, we could pick 5 or 100 probably
> 
> or a round number like 16 :)
> 
> > 
> > > And which buffer overflows?
> > 
> > stack
> 
> Okay, please add a comment like
> // arbitrary limit to prevent unbounded recursion

will apply with that

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The day soldiers stop bringing you their problems is the day you have stopped 
leading them. They have either lost confidence that you can help or concluded 
you do not care. Either case is a failure of leadership. - Colin Powell
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20210126/79a94056/attachment.sig>