[FFmpeg-devel] [PATCH] avformat/vividas: Use signed n in read_sb_block()

[Michael Niedermayer]

On Thu, Feb 25, 2021 at 09:59:40PM +0100, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote:
> >> Quoting Michael Niedermayer (2021-02-15 21:31:23)
> >>> Fixes: OOM
> >>> Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688
> >>>
> >>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> >>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> >>> ---
> >>>  libavformat/vividas.c | 2 +-
> >>>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>>
> >>> diff --git a/libavformat/vividas.c b/libavformat/vividas.c
> >>> index d745770dc4..b172a48b29 100644
> >>> --- a/libavformat/vividas.c
> >>> +++ b/libavformat/vividas.c
> >>> @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size,
> >>>      uint8_t *buf;
> >>>      uint8_t ibuf[8], sbuf[8];
> >>>      uint32_t k2;
> >>> -    unsigned n;
> >>> +    int n;
> >>>  
> >>
> >> Why would that be better, when it's assigned a uint32_t?
> > 
> > one (maybe not the only one) issue is
> > if (avio_read(src, buf+8, n) < n) {
> > 
> > avio_read() returns int and has a int size
> > so this will not work at all with a unsigned int, not only will it not read
> > more than INT_MAX it also when it fails with an error fail to treat it as 
> > an error
> > 
> > do you prefer a diferent solution ?
> > 
> ffio_read_size? Or just use != instead of <? Or check for n > INT_MAX
> before the call?

will apply with an != check instead

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Opposition brings concord. Out of discord comes the fairest harmony.
-- Heraclitus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20210328/a5773916/attachment.sig>