[FFmpeg-devel] [PATCH] fftools/ffmpeg: avoid possible invalid reads with short -tag values

[James Almer]

On 4/13/2023 10:59 AM, Anton Khirnov wrote:
> Fixes #10319.
> ---
>   fftools/ffmpeg_demux.c    | 8 ++++++--
>   fftools/ffmpeg_mux_init.c | 7 +++++--
>   2 files changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c
> index b9849d1669..d89e28b9f6 100644
> --- a/fftools/ffmpeg_demux.c
> +++ b/fftools/ffmpeg_demux.c
> @@ -736,8 +736,12 @@ static void add_input_streams(const OptionsContext *o, Demuxer *d)
>           MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, ic, st);
>           if (codec_tag) {
>               uint32_t tag = strtol(codec_tag, &next, 0);
> -            if (*next)
> -                tag = AV_RL32(codec_tag);
> +            if (*next) {
> +                uint8_t buf[4] = { 0 };
> +                memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag)));
> +                tag = AV_RL32(buf);
> +            }
> +
>               st->codecpar->codec_tag = tag;
>           }
>   
> diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c
> index 62e5643a04..aab423464c 100644
> --- a/fftools/ffmpeg_mux_init.c
> +++ b/fftools/ffmpeg_mux_init.c
> @@ -610,8 +610,11 @@ static OutputStream *new_output_stream(Muxer *mux, const OptionsContext *o,
>       MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, oc, st);
>       if (codec_tag) {
>           uint32_t tag = strtol(codec_tag, &next, 0);
> -        if (*next)
> -            tag = AV_RL32(codec_tag);
> +        if (*next) {
> +            uint8_t buf[4] = { 0 };
> +            memcpy(buf, codec_tag, FFMIN(sizeof(buf), strlen(codec_tag)));
> +            tag = AV_RL32(buf);
> +        }
>           ost->st->codecpar->codec_tag = tag;
>           if (ost->enc_ctx)
>               ost->enc_ctx->codec_tag = tag;

LGTM.