November 2012 - ffmpeg-cvslog

check std tag size before reading.
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Sat Dec 1 00:29:39 2012 +0100| [b90e795f737c5efb9f65869b304e87a0985b046d] | committer: Michael Niedermayer check std tag size before reading. Fixes out of array read Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b90e795f737c5efb9… --- libavformat/4xm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/4xm.c b/libavformat/4xm.c index 0a003d4..1e142f5 100644 --- a/libavformat/4xm.c +++ b/libavformat/4xm.c @@ -134,6 +134,10 @@ static int fourxm_read_header(AVFormatContext *s) } if (fourcc_tag == std__TAG) { + if (header_size < i + 16) { + av_log(s, AV_LOG_ERROR, "std TAG truncated\n"); + return AVERROR_INVALIDDATA; + } fourxm->fps = av_int2float(AV_RL32(&header[i + 12])); } else if (fourcc_tag == vtrk_TAG) { /* check that there is enough data */

1 0

qdm2: check array index before use, fix out of array accesses
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Fri Nov 30 23:59:40 2012 +0100| [a7ee6281f7ef1c29284e3a4cadfe0f227ffde1ed] | committer: Michael Niedermayer qdm2: check array index before use, fix out of array accesses Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a7ee6281f7ef1c292… --- libavcodec/qdm2.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c index 4cf4b2f..1dfb8d5 100644 --- a/libavcodec/qdm2.c +++ b/libavcodec/qdm2.c @@ -1257,6 +1257,11 @@ static void qdm2_decode_super_block (QDM2Context *q) for (i = 0; packet_bytes > 0; i++) { int j; + if (i>=FF_ARRAY_ELEMS(q->sub_packet_list_A)) { + SAMPLES_NEEDED_2("too many packet bytes"); + return; + } + q->sub_packet_list_A[i].next = NULL; if (i > 0) {

1 0

dxa: check reference frame availability before use.
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Fri Nov 30 20:58:26 2012 +0100| [7205e896a1ceb0e5c0256ed9cc1f69cf1fe664d4] | committer: Michael Niedermayer dxa: check reference frame availability before use. Fix NULL pointer dereference Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7205e896a1ceb0e5c… --- libavcodec/dxa.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/dxa.c b/libavcodec/dxa.c index d43e113..cf8ce0c 100644 --- a/libavcodec/dxa.c +++ b/libavcodec/dxa.c @@ -270,6 +270,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac case 13: c->pic.key_frame = 0; c->pic.pict_type = AV_PICTURE_TYPE_P; + if (!c->prev.data[0]) { + av_log(avctx, AV_LOG_ERROR, "Missing reference frame\n"); + return AVERROR_INVALIDDATA; + } decode_13(avctx, c, c->pic.data[0], srcptr, c->prev.data[0]); break; default:

1 0

aacps: check iid/icc_par more completely.
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Fri Nov 30 19:24:56 2012 +0100| [991e23519ac53adc624338b3a7628c9c289268cb] | committer: Michael Niedermayer aacps: check iid/icc_par more completely. Fixes global out of array read. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=991e23519ac53adc6… --- libavcodec/aacps.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/libavcodec/aacps.c b/libavcodec/aacps.c index c8002e2..25ed1d0 100644 --- a/libavcodec/aacps.c +++ b/libavcodec/aacps.c @@ -236,6 +236,7 @@ int ff_ps_read_data(AVCodecContext *avctx, GetBitContext *gb_host, PSContext *ps if (!ps->num_env || ps->border_position[ps->num_env] < numQMFSlots - 1) { //Create a fake envelope int source = ps->num_env ? ps->num_env - 1 : ps->num_env_old - 1; + int b; if (source >= 0 && source != ps->num_env) { if (ps->enable_iid) { memcpy(ps->iid_par+ps->num_env, ps->iid_par+source, sizeof(ps->iid_par[0])); @@ -248,6 +249,22 @@ int ff_ps_read_data(AVCodecContext *avctx, GetBitContext *gb_host, PSContext *ps memcpy(ps->opd_par+ps->num_env, ps->opd_par+source, sizeof(ps->opd_par[0])); } } + if (ps->enable_iid){ + for (b = 0; b < ps->nr_iid_par; b++) { + if (FFABS(ps->iid_par[ps->num_env][b]) > 7 + 8 * ps->iid_quant) { + av_log(avctx, AV_LOG_ERROR, "iid_par invalid\n"); + goto err; + } + } + } + if (ps->enable_icc){ + for (b = 0; b < ps->nr_iid_par; b++) { + if (ps->icc_par[ps->num_env][b] > 7U) { + av_log(avctx, AV_LOG_ERROR, "icc_par invalid\n"); + goto err; + } + } + } ps->num_env++; ps->border_position[ps->num_env] = numQMFSlots - 1; }

1 0

Additional checks to prevent overread.
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Vitaliy E Sugrobov <vsugrob(a)hotmail.com> | Fri Nov 30 12:58:54 2012 +0400| [de0cb7f070dc941ea2d3f8a99dad497c852b4e35] | committer: Paul B Mahol Additional checks to prevent overread. Check for availability of some required amount of bytes in buffer before reading further. Signed-off-by: Vitaliy E Sugrobov <vsugrob(a)hotmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=de0cb7f070dc941ea… --- libavcodec/gifdec.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/libavcodec/gifdec.c b/libavcodec/gifdec.c index 887a253..2213733 100755 --- a/libavcodec/gifdec.c +++ b/libavcodec/gifdec.c @@ -146,6 +146,10 @@ static int gif_read_image(GifState *s) int ret; uint8_t *idx; + /* At least 9 bytes of Image Descriptor. */ + if (s->bytestream_end < s->bytestream + 9) + return AVERROR_INVALIDDATA; + left = bytestream_get_le16(&s->bytestream); top = bytestream_get_le16(&s->bytestream); width = bytestream_get_le16(&s->bytestream); @@ -222,6 +226,10 @@ static int gif_read_image(GifState *s) } } + /* Expect at least 2 bytes: 1 for lzw code size and 1 for block size. */ + if (s->bytestream_end < s->bytestream + 2) + return AVERROR_INVALIDDATA; + /* now get the image data */ code_size = bytestream_get_byte(&s->bytestream); if ((ret = ff_lzw_decode_init(s->lzw, code_size, s->bytestream, @@ -296,7 +304,11 @@ static int gif_read_extension(GifState *s) { int ext_code, ext_len, i, gce_flags, gce_transparent_index; - /* extension */ + /* There must be at least 2 bytes: + * 1 for extension label and 1 for extension length. */ + if (s->bytestream_end < s->bytestream + 2) + return AVERROR_INVALIDDATA; + ext_code = bytestream_get_byte(&s->bytestream); ext_len = bytestream_get_byte(&s->bytestream); @@ -306,6 +318,12 @@ static int gif_read_extension(GifState *s) case GIF_GCE_EXT_LABEL: if (ext_len != 4) goto discard_ext; + + /* We need at least 5 bytes more: 4 is for extension body + * and 1 for next block size. */ + if (s->bytestream_end < s->bytestream + 5) + return AVERROR_INVALIDDATA; + s->transparent_color_index = -1; gce_flags = bytestream_get_byte(&s->bytestream); bytestream_get_le16(&s->bytestream); // delay during which the frame is shown @@ -332,6 +350,10 @@ static int gif_read_extension(GifState *s) /* NOTE: many extension blocks can come after */ discard_ext: while (ext_len != 0) { + /* There must be at least ext_len bytes and 1 for next block size byte. */ + if (s->bytestream_end < s->bytestream + ext_len + 1) + return AVERROR_INVALIDDATA; + for (i = 0; i < ext_len; i++) bytestream_get_byte(&s->bytestream); ext_len = bytestream_get_byte(&s->bytestream);

2 1

update Changelog
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Fri Nov 30 16:51:44 2012 +0000| [daede25f0b3338340aac3e87c30d288ee00af9b8] | committer: Paul B Mahol update Changelog Signed-off-by: Paul B Mahol <onemda(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=daede25f0b3338340… --- Changelog | 1 + 1 file changed, 1 insertion(+) diff --git a/Changelog b/Changelog index 5d605c6..6ebd07d 100644 --- a/Changelog +++ b/Changelog @@ -31,6 +31,7 @@ version <next>: - ffprobe -sections option - ADPCM IMA Dialogic decoder - BRSTM demuxer +- animated GIF decoder and demuxer version 1.0:

1 0

gifdec: remove width and height from demuxer context
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Fri Nov 30 16:09:02 2012 +0000| [57b00d7ab1e39004831417a94c126d6fad583cbd] | committer: Paul B Mahol gifdec: remove width and height from demuxer context Signed-off-by: Paul B Mahol <onemda(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=57b00d7ab1e390048… --- libavformat/gifdec.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/libavformat/gifdec.c b/libavformat/gifdec.c index f566239..706bc5a 100644 --- a/libavformat/gifdec.c +++ b/libavformat/gifdec.c @@ -32,8 +32,6 @@ typedef struct GIFDemuxContext { const AVClass *class; - uint32_t width; - uint32_t height; /** * Time span in hundredths of second before * the next frame should be drawn on screen. @@ -79,17 +77,17 @@ static int gif_read_header(AVFormatContext *s) GIFDemuxContext *gdc = s->priv_data; AVIOContext *pb = s->pb; AVStream *st; - int ret; + int width, height, ret; /* skip 6-byte magick */ if ((ret = avio_skip(pb, 6)) < 0) return ret; gdc->delay = gdc->default_delay; - gdc->width = avio_rl16(pb); - gdc->height = avio_rl16(pb); + width = avio_rl16(pb); + height = avio_rl16(pb); - if (gdc->width == 0 || gdc->height == 0) + if (width == 0 || height == 0) return AVERROR_INVALIDDATA; st = avformat_new_stream(s, NULL); @@ -101,8 +99,8 @@ static int gif_read_header(AVFormatContext *s) avpriv_set_pts_info(st, 64, 1, 100); st->codec->codec_type = AVMEDIA_TYPE_VIDEO; st->codec->codec_id = AV_CODEC_ID_GIF; - st->codec->width = gdc->width; - st->codec->height = gdc->height; + st->codec->width = width; + st->codec->height = height; /* jump to start because gif decoder needs header data too */ if (avio_seek(pb, 0, SEEK_SET) != 0)

1 0

smacker: more complete vlc length check, fixes out of array read
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Fri Nov 30 16:00:07 2012 +0100| [2c69fcc2ffe671649e56dc981e9f4cd9d46a61be] | committer: Michael Niedermayer smacker: more complete vlc length check, fixes out of array read Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2c69fcc2ffe671649… --- libavcodec/smacker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index 095f0d0..e1e67da 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -96,7 +96,7 @@ enum SmkBlockTypes { */ static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t prefix, int length) { - if(length > 32) { + if(length > 32 || length > 3*SMKTREE_BITS) { av_log(NULL, AV_LOG_ERROR, "length too long\n"); return AVERROR_INVALIDDATA; }

1 0

smacker: check smacker_decode_tree() return value
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Fri Nov 30 15:58:19 2012 +0100| [50cbe09d8ced75422571d29bbec1f35a33a0d3ed] | committer: Michael Niedermayer smacker: check smacker_decode_tree() return value Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=50cbe09d8ced75422… --- libavcodec/smacker.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index ce1262d..095f0d0 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -205,7 +205,9 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int tmp2.values = av_mallocz(256 * sizeof(int)); if(get_bits1(gb)) { - smacker_decode_tree(gb, &tmp1, 0, 0); + res = smacker_decode_tree(gb, &tmp1, 0, 0); + if (res < 0) + return res; skip_bits1(gb); if(tmp1.current > 1) { res = init_vlc(&vlc[0], SMKTREE_BITS, tmp1.length, @@ -221,7 +223,9 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int av_log(smk->avctx, AV_LOG_ERROR, "Skipping low bytes tree\n"); } if(get_bits1(gb)){ - smacker_decode_tree(gb, &tmp2, 0, 0); + res = smacker_decode_tree(gb, &tmp2, 0, 0); + if (res < 0) + return res; skip_bits1(gb); if(tmp2.current > 1) { res = init_vlc(&vlc[1], SMKTREE_BITS, tmp2.length, @@ -655,7 +659,9 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, h[i].lengths = av_mallocz(256 * sizeof(int)); h[i].values = av_mallocz(256 * sizeof(int)); skip_bits1(&gb); - smacker_decode_tree(&gb, &h[i], 0, 0); + res = smacker_decode_tree(&gb, &h[i], 0, 0); + if (res < 0) + return res; skip_bits1(&gb); if(h[i].current > 1) { res = init_vlc(&vlc[i], SMKTREE_BITS, h[i].length,

1 0

undo file modifiers that suck in
by git＠videolan.org 30 Nov '12

30 Nov '12

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Fri Nov 30 15:00:35 2012 +0000| [d56b15017a1e4edf302cb4b7e6bdf8eb12a0a407] | committer: Paul B Mahol undo file modifiers that suck in Signed-off-by: Paul B Mahol <onemda(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d56b15017a1e4edf3… --- 0 files changed diff --git a/libavcodec/gif.h b/libavcodec/gif.h old mode 100755 new mode 100644 diff --git a/libavcodec/gifdec.c b/libavcodec/gifdec.c old mode 100755 new mode 100644 diff --git a/libavformat/gifdec.c b/libavformat/gifdec.c old mode 100755 new mode 100644

1 0