From 6fbb21d6858b9d0152f89e1b30ffe683a9d33948 Mon Sep 17 00:00:00 2001 From: Nicolas George Date: Sat, 13 Apr 2013 11:27:52 +0200 Subject: [PATCH 1/4] lavfi/buffersink: factor checks for lists sizes. --- libavfilter/buffersink.c | 34 ++++++++++++---------------------- 1 file changed, 12 insertions(+), 22 deletions(-) diff --git a/libavfilter/buffersink.c b/libavfilter/buffersink.c index 769be8352c..14ead2bb0c 100644 --- a/libavfilter/buffersink.c +++ b/libavfilter/buffersink.c @@ -384,6 +384,13 @@ static av_cold int vsink_init(AVFilterContext *ctx, void *opaque) return common_init(ctx); } +#define CHECK_LIST_SIZE(field) \ + if (buf->field ## _size % sizeof(*buf->field)) { \ + av_log(ctx, AV_LOG_ERROR, "Invalid size for " #field ": %d, " \ + "should be multiple of %d\n", \ + buf->field ## _size, (int)sizeof(*buf->field)); \ + return AVERROR(EINVAL); \ + } static int vsink_query_formats(AVFilterContext *ctx) { BufferSinkContext *buf = ctx->priv; @@ -391,11 +398,7 @@ static int vsink_query_formats(AVFilterContext *ctx) unsigned i; int ret; - if (buf->pixel_fmts_size % sizeof(*buf->pixel_fmts)) { - av_log(ctx, AV_LOG_ERROR, "Invalid size for format list\n"); - return AVERROR(EINVAL); - } - + CHECK_LIST_SIZE(pixel_fmts) if (buf->pixel_fmts_size) { for (i = 0; i < NB_ITEMS(buf->pixel_fmts); i++) if ((ret = ff_add_format(&formats, buf->pixel_fmts[i])) < 0) @@ -433,23 +436,10 @@ static int asink_query_formats(AVFilterContext *ctx) unsigned i; int ret; - if (buf->sample_fmts_size % sizeof(*buf->sample_fmts) || - buf->sample_rates_size % sizeof(*buf->sample_rates) || - buf->channel_layouts_size % sizeof(*buf->channel_layouts) || - buf->channel_counts_size % sizeof(*buf->channel_counts)) { - av_log(ctx, AV_LOG_ERROR, "Invalid size for format lists\n"); -#define LOG_ERROR(field) \ - if (buf->field ## _size % sizeof(*buf->field)) \ - av_log(ctx, AV_LOG_ERROR, " " #field " is %d, should be " \ - "multiple of %d\n", \ - buf->field ## _size, (int)sizeof(*buf->field)); - LOG_ERROR(sample_fmts); - LOG_ERROR(sample_rates); - LOG_ERROR(channel_layouts); - LOG_ERROR(channel_counts); -#undef LOG_ERROR - return AVERROR(EINVAL); - } + CHECK_LIST_SIZE(sample_fmts) + CHECK_LIST_SIZE(sample_rates) + CHECK_LIST_SIZE(channel_layouts) + CHECK_LIST_SIZE(channel_counts) if (buf->sample_fmts_size) { for (i = 0; i < NB_ITEMS(buf->sample_fmts); i++) From 76c8060654f01aa270b9169b884902289a7ebf64 Mon Sep 17 00:00:00 2001 From: Nicolas George Date: Sat, 13 Apr 2013 11:37:16 +0200 Subject: [PATCH 2/4] lavu: add av_pure to av_int_list_length_for_size. --- libavutil/avutil.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavutil/avutil.h b/libavutil/avutil.h index d71eb1ef4c..fd9bdc88a7 100644 --- a/libavutil/avutil.h +++ b/libavutil/avutil.h @@ -261,7 +261,7 @@ static inline void *av_x_if_null(const void *p, const void *x) * @return length of the list, in elements, not counting the terminator */ unsigned av_int_list_length_for_size(unsigned elsize, - const void *list, uint64_t term); + const void *list, uint64_t term) av_pure; /** * Compute the length of an integer list. From 2a1d7ea5f8ba71e1ed96c17414f8d106c006d87a Mon Sep 17 00:00:00 2001 From: Nicolas George Date: Sat, 13 Apr 2013 11:47:27 +0200 Subject: [PATCH 3/4] lavu: add parens to macro argument. --- libavutil/avutil.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavutil/avutil.h b/libavutil/avutil.h index fd9bdc88a7..6f307d6c5d 100644 --- a/libavutil/avutil.h +++ b/libavutil/avutil.h @@ -271,7 +271,7 @@ unsigned av_int_list_length_for_size(unsigned elsize, * @return length of the list, in elements, not counting the terminator */ #define av_int_list_length(list, term) \ - av_int_list_length_for_size(sizeof(*list), list, term) + av_int_list_length_for_size(sizeof(*(list)), list, term) /** * @} From 9e8e03de38b3deb6bee546a37e1a3ff05cf5f746 Mon Sep 17 00:00:00 2001 From: Nicolas George Date: Sat, 13 Apr 2013 11:46:56 +0200 Subject: [PATCH 4/4] lavu/opt: check int lists length for overflow. Also add parens on macro arguments. --- libavutil/opt.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavutil/opt.h b/libavutil/opt.h index e368259455..7f7b54e708 100644 --- a/libavutil/opt.h +++ b/libavutil/opt.h @@ -668,8 +668,10 @@ int av_opt_set_video_rate(void *obj, const char *name, AVRational val, int searc * @param flags search flags */ #define av_opt_set_int_list(obj, name, val, term, flags) \ - av_opt_set_bin(obj, name, (const uint8_t *)val, \ - av_int_list_length(val, term) * sizeof(*val), flags) + (av_int_list_length(val, term) > INT_MAX / sizeof(*(val)) ? \ + AVERROR(EINVAL) : \ + av_opt_set_bin(obj, name, (const uint8_t *)(val), \ + av_int_list_length(val, term) * sizeof(*(val)), flags)) /** * @} */