[FFmpeg-devel] [PATCH v3 00/11] libavformat/asf: fix handling of byte array length values
ffmpegagent
ffmpegagent at gmail.com
Sun May 8 06:01:11 EEST 2022
The spec allows attachment sizes of up to UINT32_MAX while we can handle
only sizes up to INT32_MAX (in downstream code)
The debug.assert in get_tag didn't really address this, and truncating the
value_len in calling methods cannot be used because the length value is
required in order to continue parsing. This adds a check with log message in
ff_asf_handle_byte_array to handle those (rare) cases.
v2: Rebased & PING v3: Adjustments suggested by Michael
softworkz (11):
libavformat/asf: fix handling of byte array length values
libavformat/asfdec: fix get_value return type and add checks for
libavformat/asfdec: fix type of value_len
libavformat/asfdec: fixing get_tag
libavformat/asfdec: implement parsing of GUID values
libavformat/asfdec: remove unused parameters
libavformat/asfdec: fix macro definition and use
libavformat/asfdec: remove variable redefinition in inner scope
libavformat/asfdec: ensure variables are initialized
libavformat/asfdec: fix parameter type in asf_read_stream_propertie()
libavformat/asfdec: fix variable types and add checks for unsupported
values
libavformat/asf.c | 8 +-
libavformat/asf.h | 2 +-
libavformat/asfdec_f.c | 368 ++++++++++++++++++++++++++---------------
3 files changed, 244 insertions(+), 134 deletions(-)
base-commit: f1c19867d72a14699277175101b2bcf1e333af88
Published-As: https://github.com/ffstaging/FFmpeg/releases/tag/pr-ffstaging-12%2Fsoftworkz%2Fmaster-upstream_asf_4-v3
Fetch-It-Via: git fetch https://github.com/ffstaging/FFmpeg pr-ffstaging-12/softworkz/master-upstream_asf_4-v3
Pull-Request: https://github.com/ffstaging/FFmpeg/pull/12
Range-diff vs v2:
1: 0056a93a34 ! 1: b5c56bf5d0 libavformat/asf: fix handling of byte array length values
@@ libavformat/asf.c: static int get_id3_tag(AVFormatContext *s, int len)
+ }
+
if (!strcmp(name, "WM/Picture")) // handle cover art
-- return asf_read_picture(s, val_len);
-+ return asf_read_picture(s, (int)val_len);
+ return asf_read_picture(s, val_len);
else if (!strcmp(name, "ID3")) // handle ID3 tag
-- return get_id3_tag(s, val_len);
-+ return get_id3_tag(s, (int)val_len);
+ return get_id3_tag(s, val_len);
-+ av_log(s, AV_LOG_VERBOSE, "Unsupported byte array in tag %s.\n", name);
++ av_log(s, AV_LOG_DEBUG, "Unsupported byte array in tag %s.\n", name);
return 1;
}
2: a35b7c87d4 ! 2: e6aa0fb7f3 libavformat/asfdec: fix get_value return type and add checks for
@@ libavformat/asfdec_f.c: static int asf_probe(const AVProbeData *pd)
{
switch (type) {
case ASF_BOOL:
+@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size)
+ {
+ AVIOContext *pb = s->pb;
+ ASFContext *asf = s->priv_data;
++ uint64_t dar_num = 0;
++ uint64_t dar_den = 0;
+ int desc_count, i, ret;
+
+ desc_count = avio_rl16(pb);
@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s, int64_t size)
/* My sample has that stream set to 0 maybe that mean the container.
* ASF stream count starts at 1. I am using 0 to the container value
@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s,
- else if (!strcmp(name, "AspectRatioY"))
- asf->dar[0].den = get_value(s->pb, value_type, 32);
+ if (!strcmp(name, "AspectRatioX")) {
-+ const uint64_t value = get_value(s->pb, value_type, 32);
-+ if (value > INT32_MAX) {
-+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", value);
++ dar_num = get_value(s->pb, value_type, 32);
++ if (dar_num > INT64_MAX) {
++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num);
+ return AVERROR(ENOTSUP);
+ }
-+ asf->dar[0].num = (int)value;
+ }
+ else if (!strcmp(name, "AspectRatioY")) {
-+ const uint64_t value = get_value(s->pb, value_type, 32);
-+ if (value > INT32_MAX) {
-+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", value);
++ dar_den = get_value(s->pb, value_type, 32);
++ if (dar_den > INT64_MAX) {
++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den);
+ return AVERROR(ENOTSUP);
+ }
-+ asf->dar[0].den = (int)value;
+ }
else
get_tag(s, name, value_type, value_len, 32);
}
+
++ if (dar_num && dar_den)
++ av_reduce(&asf->dar[0].num, &asf->dar[0].den, dar_num, dar_den, INT_MAX);
++
+ return 0;
+ }
+
+@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size)
+ {
+ AVIOContext *pb = s->pb;
+ ASFContext *asf = s->priv_data;
++ uint64_t dar_num[128] = {0};
++ uint64_t dar_den[128] = {0};
+ int n, stream_num, name_len_utf16, name_len_utf8, value_len;
+ int ret, i;
+ n = avio_rl16(pb);
@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size)
+ av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n",
i, stream_num, name_len_utf16, value_type, value_len, name);
- if (!strcmp(name, "AspectRatioX")){
+- if (!strcmp(name, "AspectRatioX")){
- int aspect_x = get_value(s->pb, value_type, 16);
-+ const uint64_t aspect_x = get_value(s->pb, value_type, 16);
-+ if (aspect_x > INT32_MAX) {
-+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", aspect_x);
-+ return AVERROR(ENOTSUP);
-+ }
- if(stream_num < 128)
+- if(stream_num < 128)
- asf->dar[stream_num].num = aspect_x;
-+ asf->dar[stream_num].num = (int)aspect_x;
- } else if(!strcmp(name, "AspectRatioY")){
+- } else if(!strcmp(name, "AspectRatioY")){
- int aspect_y = get_value(s->pb, value_type, 16);
-+ const uint64_t aspect_y = get_value(s->pb, value_type, 16);
-+ if (aspect_y > INT32_MAX) {
-+ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", aspect_y);
+- if(stream_num < 128)
+- asf->dar[stream_num].den = aspect_y;
+- } else {
++ if (!strcmp(name, "AspectRatioX") && stream_num < 128) {
++ dar_num[stream_num] = get_value(s->pb, value_type, 16);
++ if (dar_num[stream_num] > INT64_MAX) {
++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioX value: %"PRIu64"\n", dar_num[stream_num]);
+ return AVERROR(ENOTSUP);
+ }
- if(stream_num < 128)
-- asf->dar[stream_num].den = aspect_y;
-+ asf->dar[stream_num].den = (int)aspect_y;
- } else {
++ }
++ else if (!strcmp(name, "AspectRatioY") && stream_num < 128) {
++ dar_den[stream_num] = get_value(s->pb, value_type, 16);
++ if (dar_den[stream_num] > INT64_MAX) {
++ av_log(s, AV_LOG_DEBUG, "Unsupported AspectRatioY value: %"PRIu64"\n", dar_den[stream_num]);
++ return AVERROR(ENOTSUP);
++ }
++ } else
get_tag(s, name, value_type, value_len, 16);
++
++
++ if (stream_num < 128 && dar_num[stream_num] && dar_den[stream_num]) {
++ av_reduce(&asf->dar[stream_num].num, &asf->dar[stream_num].den, dar_num[stream_num], dar_den[stream_num], INT_MAX);
++ dar_num[stream_num] = 0;
++ dar_den[stream_num] = 0;
}
++
+ av_freep(&name);
+ }
+
3: b8039dc4cf ! 3: b84474d729 libavformat/asfdec: fix type of value_len
@@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex
len1 = avio_rl16(pb);
len2 = avio_rl16(pb);
@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s, int64_t size)
- {
- AVIOContext *pb = s->pb;
ASFContext *asf = s->priv_data;
+ uint64_t dar_num[128] = {0};
+ uint64_t dar_den[128] = {0};
- int n, stream_num, name_len_utf16, name_len_utf8, value_len;
+ int n, name_len_utf8;
+ uint16_t stream_num, name_len_utf16, value_type;
4: 6e19df6e89 = 4: a54feb51a1 libavformat/asfdec: fixing get_tag
5: 0f3c417efe = 5: e14beb2c15 libavformat/asfdec: implement parsing of GUID values
6: 3bee11e40f = 6: 06062da88b libavformat/asfdec: remove unused parameters
7: ca9bbc79de = 7: 273823a5b4 libavformat/asfdec: fix macro definition and use
8: 238290bbce = 8: aaa37aca21 libavformat/asfdec: remove variable redefinition in inner scope
9: 654e44d526 = 9: 6aedb68b76 libavformat/asfdec: ensure variables are initialized
10: d461f039d2 = 10: 28ebbe7289 libavformat/asfdec: fix parameter type in asf_read_stream_propertie()
11: f606f322bb ! 11: bbeee5f2da libavformat/asfdec: fix variable types and add checks for unsupported values
@@ libavformat/asfdec_f.c: static int asf_read_ext_stream_properties(AVFormatContex
if (stream_num < 128 && i < FF_ARRAY_ELEMS(asf->streams[stream_num].payload)) {
ASFPayload *p = &asf->streams[stream_num].payload[i];
@@ libavformat/asfdec_f.c: static int asf_read_ext_content_desc(AVFormatContext *s)
- {
- AVIOContext *pb = s->pb;
ASFContext *asf = s->priv_data;
+ uint64_t dar_num = 0;
+ uint64_t dar_den = 0;
- int desc_count, i, ret;
+ uint16_t desc_count, i;
+ int ret;
@@ libavformat/asfdec_f.c: static int asf_read_language_list(AVFormatContext *s)
av_strlcpy(asf->stream_languages[j], lang,
sizeof(*asf->stream_languages));
@@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s)
- {
- AVIOContext *pb = s->pb;
ASFContext *asf = s->priv_data;
+ uint64_t dar_num[128] = {0};
+ uint64_t dar_den[128] = {0};
- int n, name_len_utf8;
- uint16_t stream_num, name_len_utf16, value_type;
+ int name_len_utf8;
--
ffmpeg-codebot
More information about the ffmpeg-devel
mailing list