[FFmpeg-devel] [PATCH] ogg: Fix OOB write during ogg_read_seek()

[Dale Curtis]

On Mon, Apr 16, 2012 at 8:00 PM, Michael Niedermayer <michaelni at gmx.at>wrote:

>
> On Mon, Apr 16, 2012 at 01:57:21PM -0700, dalecurtis at chromium.org wrote:
> > From: Dale Curtis <dalecurtis at chromium.org>
> >
> > Prevents an OOB write of size 4 when ogg_read_seek is called with
> > a stream_index >= ogg->nstreams.
> >
> > In this case s->nb_streams == 3, yet ogg->nstreams == 1 and
> > stream_index == 1; causing os->keyframe_seek = 1 to write OOB.
> >
>
> > Test case available on request.
>
> i tried both valgrind and address sanitizer, neither shows anything
> invalid with
> ./ffmpeg_g -i oob-write.ogv  -f null -
>
> maybe reimar could take a look at the patch, iam a bit tired and
> need to sleep a few hours ...
>
>
Did you try seeking in ffplay? I was able to induce a crash, but ASAN
should show the issue. Aside from that, logging the values of ogg->nstreams
and stream_index in ogg_read_seek will show the issue. Here's the relevant
ASAN snippet from Chrome:

WRITE of size 4 at 0x7fbd4e8bc37c thread T22
    #0 0x7fbd4e53d63b in ogg_read_seek
chrome-asan/src/third_party/ffmpeg/libavformat/oggdec.c:711
    #1 0x7fbd4e559bf7 in av_seek_frame
chrome-asan/src/third_party/ffmpeg/libavformat/utils.c:1772

(line numbers slightly off due to older FFmpeg cut in trace).

- dale