RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/avidec: Prevent entity expansion attacks 

Fixes: Timeout
Fixes no testcase, this is the same idea as similar attacks against XML parsers

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3e823c2aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-08-18 00:22:41 +02:00
parent 457941c11a
commit 28f1396cfb
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavformat/avidec.c
View File

@ -80,6 +80,8 @@ typedef struct AVIContext {
int stream_index; int stream_index;
DVDemuxContext *dv_demux; DVDemuxContext *dv_demux;
int odml_depth; int odml_depth;
int64_t odml_read;
int64_t odml_max_pos;
int use_odml; int use_odml;
#define MAX_ODML_DEPTH 1000 #define MAX_ODML_DEPTH 1000
int64_t dts_max; int64_t dts_max;
@ -189,7 +191,7 @@ static int read_odml_index(AVFormatContext *s, int64_t frame_num)
st = s->streams[stream_id]; st = s->streams[stream_id];
ast = st->priv_data; ast = st->priv_data;
if (index_sub_type) if (index_sub_type || entries_in_use < 0)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
avio_rl32(pb); avio_rl32(pb);
@ -210,11 +212,18 @@ static int read_odml_index(AVFormatContext *s, int64_t frame_num)
} }
for (i = 0; i < entries_in_use; i++) { for (i = 0; i < entries_in_use; i++) {
avi->odml_max_pos = FFMAX(avi->odml_max_pos, avio_tell(pb));
// If we read more than there are bytes then we must have been reading something twice
if (avi->odml_read > avi->odml_max_pos)
return AVERROR_INVALIDDATA;
if (index_type) { if (index_type) {
int64_t pos = avio_rl32(pb) + base - 8; int64_t pos = avio_rl32(pb) + base - 8;
int len = avio_rl32(pb); int len = avio_rl32(pb);
int key = len >= 0; int key = len >= 0;
len &= 0x7FFFFFFF; len &= 0x7FFFFFFF;
avi->odml_read += 8;
av_log(s, AV_LOG_TRACE, "pos:%"PRId64", len:%X\n", pos, len); av_log(s, AV_LOG_TRACE, "pos:%"PRId64", len:%X\n", pos, len);
@ -233,6 +242,7 @@ static int read_odml_index(AVFormatContext *s, int64_t frame_num)
int64_t offset, pos; int64_t offset, pos;
int duration; int duration;
int ret; int ret;
avi->odml_read += 16;
offset = avio_rl64(pb); offset = avio_rl64(pb);
avio_rl32(pb); /* size */ avio_rl32(pb); /* size */