[FFmpeg-devel] [PATCH] avcodec/avcodec: Limit the number of side data elements per packet

Michael Niedermayer michael at niedermayer.cc
Fri May 12 15:20:26 EEST 2017


On Fri, May 12, 2017 at 06:16:38AM +0200, wm4 wrote:
> On Thu, 11 May 2017 23:27:37 +0200
> Michael Niedermayer <michael at niedermayer.cc> wrote:
> 
> > On Thu, May 11, 2017 at 06:54:16PM +0200, wm4 wrote:
> > > On Thu, 11 May 2017 13:01:36 +0200
> > > Michael Niedermayer <michael at niedermayer.cc> wrote:
> > >   
> > > > Fixes: 1293/clusterfuzz-testcase-minimized-6054752074858496
> > > > 
> > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
> > > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > > ---
> > > >  libavcodec/avcodec.h  | 8 ++++++++
> > > >  libavcodec/avpacket.c | 5 ++++-
> > > >  2 files changed, 12 insertions(+), 1 deletion(-)
> > > > 
> > > > diff --git a/libavcodec/avcodec.h b/libavcodec/avcodec.h
> > > > index df6d2bc748..173c083a86 100644
> > > > --- a/libavcodec/avcodec.h
> > > > +++ b/libavcodec/avcodec.h
> > > > @@ -1593,6 +1593,14 @@ enum AVPacketSideDataType {
> > > >       * AVContentLightMetadata struct.
> > > >       */
> > > >      AV_PKT_DATA_CONTENT_LIGHT_LEVEL,
> > > > +
> > > > +    /**
> > > > +     * The number of side data elements (in fact a bit more than it).
> > > > +     * This is not part of the public API/ABI in the sense that it may
> > > > +     * change when new side data types are added.
> > > > +     * This must stay the last enum value.
> > > > +     */
> > > > +    AV_PKT_DATA_NB,
> > > >  };  
> > > 
> > > OK I guess.
> > >   
> > > >  #define AV_PKT_DATA_QUALITY_FACTOR AV_PKT_DATA_QUALITY_STATS //DEPRECATED
> > > > diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c
> > > > index 369dd78208..200ba99f34 100644
> > > > --- a/libavcodec/avpacket.c
> > > > +++ b/libavcodec/avpacket.c
> > > > @@ -298,7 +298,7 @@ int av_packet_add_side_data(AVPacket *pkt, enum AVPacketSideDataType type,
> > > >      AVPacketSideData *tmp;
> > > >      int elems = pkt->side_data_elems;
> > > >  
> > > > -    if ((unsigned)elems + 1 > INT_MAX / sizeof(*pkt->side_data))
> > > > +    if ((unsigned)elems + 1 > FFMIN(INT_MAX / sizeof(*pkt->side_data), AV_PKT_DATA_NB))  
> > > 
> > > Does the FFMIN and the old expression on the right side still have any
> > > function?  
> > 
> > In practice, no
> > In principle, yes, AV_PKT_DATA_NB could be larger than
> > INT_MAX / sizeof(*pkt->side_data
> 
> That seems extremely unlikely. Feel free to extend the comment on the
> new enum item to this extend.
> 
> > 
> > do you prefer if i remove it ?
> 
> Yes.

changed

applied

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Everything should be made as simple as possible, but not simpler.
-- Albert Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170512/fa290f42/attachment.sig>


More information about the ffmpeg-devel mailing list