On Mon, Dec 21, 2020 at 12:30:48PM +0100, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > No testcase
> >
> > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
> > ---
> > libavformat/aviobuf.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
> > index 78cc60b2ae..7730547106 100644
> > --- a/libavformat/aviobuf.c
> > +++ b/libavformat/aviobuf.c
> > @@ -917,6 +917,8 @@ uint64_t ffio_read_varlen(AVIOContext *bc){
> >
> > do{
> > tmp = avio_r8(bc);
> > + if (val > UINT64_MAX>>7)
> > + return AVERROR_INVALIDDATA;
> > val= (val<<7) + (tmp&127);
> > }while(tmp&128);
> > return val;
> >
> The error can't be detected at all given that the function returns an
> uint64_t.in practice the type of the destination matters. But sure you are correct that this is not "great" what do you suggest ? there are many ways to fix this also the reuse of this function between demuxers feels not entirely wise. Any change/fix must be reasonable for all demuxers, i imagine that makes the mainaince for all harder ... thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB The worst form of inequality is to try to make unequal things equal. -- Aristotle
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
