[FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative

[Marton Balint]

On Wed, 3 Apr 2024, Tomas Härdin wrote:

> mån 2024-04-01 klockan 18:22 +0200 skrev Marton Balint:
>> 
>> 
>> On Mon, 1 Apr 2024, Michael Niedermayer wrote:
>> 
>> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>> > ---
>> > libavformat/mxfdec.c | 6 +++++-
>> > 1 file changed, 5 insertions(+), 1 deletion(-)
>> > 
>> > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
>> > index e484db052ef..37446963369 100644
>> > --- a/libavformat/mxfdec.c
>> > +++ b/libavformat/mxfdec.c
>> > @@ -1245,9 +1245,13 @@ static int
>> > mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment
>> > *seg
>> > static int mxf_read_index_table_segment(void *arg, AVIOContext *pb,
>> > int tag, int size, UID uid, int64_t klv_offset)
>> > {
>> >     MXFIndexTableSegment *segment = arg;
>> > +    int tmp;
>> >     switch(tag) {
>> >     case 0x3F05:
>> > -        segment->edit_unit_byte_count = avio_rb32(pb);
>> 
>> Why not simply make segment->edit_unit_byte_count unsigned?
>
> This might run afoul with various calcultions. Speaking of,
> mxf_edit_unit_absolute_offset() does not check for multiplication
> overflows..

Michael's earlier patch fixed that, and the fix should work for both 
signed and unsigned.

Regards,
Marton