On 15.12.2015 00:43, Michael Niedermayer wrote:
> On Tue, Dec 15, 2015 at 12:03:22AM +0100, Andreas Cadhalpun wrote:
>> A negative codec_id cannot be handled by the found_decoder API of
>> AVStream->info: if the codec_id is not recognized, found_decoder is set
>> to -codec_id, which has to be '<0' according to the API documentation.
>>
>> This can cause NULL pointer dereferencing in try_decode_frame.
>>
>> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
>> ---
>> libavformat/ffmdec.c | 12 ++++++++++++
>> 1 file changed, 12 insertions(+)
>
> can avcodec_descriptor_get() be used instead of < 0 to check the codec
> ids validity ?
Yes.
> codec_type could be checked too that way
Why not. Updated patch attached.
Best regards,
Andreas
>From 3e16e9c3c32c9740c8851fd22bb60175852ffc25 Mon Sep 17 00:00:00 2001
From: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
Date: Mon, 14 Dec 2015 22:11:55 +0100
Subject: [PATCH] ffm: reject invalid codec_id and codec_type
A negative codec_id cannot be handled by the found_decoder API of
AVStream->info: if the codec_id is not recognized, found_decoder is set
to -codec_id, which has to be '<0' according to the API documentation.
This can cause NULL pointer dereferencing in try_decode_frame.
Also make sure the codec_type matches the expected one for codec_id.
Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
libavformat/ffmdec.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c
index afba905..9fe4155 100644
--- a/libavformat/ffmdec.c
+++ b/libavformat/ffmdec.c
@@ -276,6 +276,7 @@ static int ffm2_read_header(AVFormatContext *s)
AVStream *st;
AVIOContext *pb = s->pb;
AVCodecContext *codec;
+ const AVCodecDescriptor *codec_desc;
int ret;
int f_main = 0, f_cprv = -1, f_stvi = -1, f_stau = -1;
AVCodec *enc;
@@ -330,7 +331,20 @@ static int ffm2_read_header(AVFormatContext *s)
codec = st->codec;
/* generic info */
codec->codec_id = avio_rb32(pb);
+ codec_desc = avcodec_descriptor_get(codec->codec_id);
+ if (!codec_desc) {
+ av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);
+ codec->codec_id = AV_CODEC_ID_NONE;
+ goto fail;
+ }
codec->codec_type = avio_r8(pb);
+ if (codec->codec_type != codec_desc->type) {
+ av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",
+ codec_desc->type, codec->codec_type);
+ codec->codec_id = AV_CODEC_ID_NONE;
+ codec->codec_type = AVMEDIA_TYPE_UNKNOWN;
+ goto fail;
+ }
codec->bit_rate = avio_rb32(pb);
codec->flags = avio_rb32(pb);
codec->flags2 = avio_rb32(pb);
@@ -479,6 +493,7 @@ static int ffm_read_header(AVFormatContext *s)
AVStream *st;
AVIOContext *pb = s->pb;
AVCodecContext *codec;
+ const AVCodecDescriptor *codec_desc;
int i, nb_streams;
uint32_t tag;
@@ -516,7 +531,20 @@ static int ffm_read_header(AVFormatContext *s)
codec = st->codec;
/* generic info */
codec->codec_id = avio_rb32(pb);
+ codec_desc = avcodec_descriptor_get(codec->codec_id);
+ if (!codec_desc) {
+ av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);
+ codec->codec_id = AV_CODEC_ID_NONE;
+ goto fail;
+ }
codec->codec_type = avio_r8(pb); /* codec_type */
+ if (codec->codec_type != codec_desc->type) {
+ av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",
+ codec_desc->type, codec->codec_type);
+ codec->codec_id = AV_CODEC_ID_NONE;
+ codec->codec_type = AVMEDIA_TYPE_UNKNOWN;
+ goto fail;
+ }
codec->bit_rate = avio_rb32(pb);
codec->flags = avio_rb32(pb);
codec->flags2 = avio_rb32(pb);
--
2.6.2
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
