[FFmpeg-devel] [PATCH v2] libavformat/asfdec: Fix regression bug when reading image attachments

[softworkz]

From: softworkz <softworkz at hotmail.com>

Commit c8140fe7324f264faacf7395b27e12531d1f13f7 had introduced
a check for value_len > UINT16_MAX.
As a consequence, attached images of sizes larger than UINT16_MAX
could no longer be read.

This is a minimal fix of the regression, avoiding the controversies
of my earlier submission regarding int type handling in asfdec.

Signed-off-by: softworkz <softworkz at hotmail.com>
---
    libavformat/asfdec: Fix regression bug when reading image attachments
    
    Commit c8140fe7324f264faacf7395b27e12531d1f13f7 had introduced a check
    for value_len > UINT16_MAX. As a consequence, attached images of sizes
    larger than UINT16_MAX could no longer be read.
    
    This is a minimal fix of the regression, avoiding the controversies of
    my earlier submission regarding int type handling in asfdec.
    
    Signed-off-by: softworkz softworkz at hotmail.com
    
    
    Versions
    ========
    
    
    V2
    ==
    
     * Fix "new warning" detected by Patchwork

Published-As: https://github.com/ffstaging/FFmpeg/releases/tag/pr-ffstaging-70%2Fsoftworkz%2Fsubmit_asf_attachments-v2
Fetch-It-Via: git fetch https://github.com/ffstaging/FFmpeg pr-ffstaging-70/softworkz/submit_asf_attachments-v2
Pull-Request: https://github.com/ffstaging/FFmpeg/pull/70

Range-diff vs v1:

 1:  a5ce9d3d37 ! 1:  794108ed4e libavformat/asfdec: Fix regression bug when reading image attachments
     @@ libavformat/asfdec_f.c: static int asf_read_metadata(AVFormatContext *s)
               value_len  = avio_rl32(pb);
       
      -        if (value_len < 0 || value_len > UINT16_MAX)
     -+        if (value_len < 0 || value_len >= (INT_MAX - LEN) / 2)
     ++        if (value_len >= (INT_MAX - LEN) / 2)
                   return AVERROR_INVALIDDATA;
       
               name_len_utf8 = 2*name_len_utf16 + 1;


 libavformat/asfdec_f.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index 2441cadb44..ea6e8ef4f3 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -608,7 +608,8 @@ static int asf_read_metadata(AVFormatContext *s)
 {
     AVIOContext *pb = s->pb;
     ASFContext *asf = s->priv_data;
-    int n, stream_num, name_len_utf16, name_len_utf8, value_len;
+    int n, stream_num, name_len_utf16, name_len_utf8;
+    unsigned int value_len;
     int ret, i;
     n = avio_rl16(pb);
 
@@ -622,7 +623,7 @@ static int asf_read_metadata(AVFormatContext *s)
         value_type = avio_rl16(pb); /* value_type */
         value_len  = avio_rl32(pb);
 
-        if (value_len < 0 || value_len > UINT16_MAX)
+        if (value_len >= (INT_MAX - LEN) / 2)
             return AVERROR_INVALIDDATA;
 
         name_len_utf8 = 2*name_len_utf16 + 1;

base-commit: 7cd1edeaa410d977a9f1ff8436f480cb45b80178
-- 
ffmpeg-codebot