[FFmpeg-devel] [PATCH 1/2] avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2

[Michael Niedermayer]

On Fri, Jul 28, 2017 at 07:11:35PM -0300, James Almer wrote:
> On 7/28/2017 10:47 AM, Michael Niedermayer wrote:
> > Fixes: out of array accesses
> > Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV
> > 
> > Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavformat/rtmppkt.c | 60 ++++++++++++++++++++++++++++++++++-----------------
> >  1 file changed, 40 insertions(+), 20 deletions(-)
> > 
> > diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c
> > index 833a3dbade..752d92a42b 100644
> > --- a/libavformat/rtmppkt.c
> > +++ b/libavformat/rtmppkt.c
> > @@ -433,50 +433,70 @@ void ff_rtmp_packet_destroy(RTMPPacket *pkt)
> >      pkt->size = 0;
> >  }
> >  
> > -int ff_amf_tag_size(const uint8_t *data, const uint8_t *data_end)
> > +static int ff_amf_tag_skip(GetByteContext *gb)
> 
> It's static, so no ff_ prefix.
> 
> >  {
> > -    const uint8_t *base = data;
> >      AMFDataType type;
> >      unsigned nb   = -1;
> >      int parse_key = 1;
> >  
> > -    if (data >= data_end)
> > +    if (bytestream2_get_bytes_left(gb) < 1)
> >          return -1;
> > -    switch ((type = *data++)) {
> > -    case AMF_DATA_TYPE_NUMBER:      return 9;
> > -    case AMF_DATA_TYPE_BOOL:        return 2;
> > -    case AMF_DATA_TYPE_STRING:      return 3 + AV_RB16(data);
> > -    case AMF_DATA_TYPE_LONG_STRING: return 5 + AV_RB32(data);
> > -    case AMF_DATA_TYPE_NULL:        return 1;
> > -    case AMF_DATA_TYPE_DATE:        return 11;
> > +
> > +    switch ((type = bytestream2_get_byte(gb))) {
> 
> type = bytestream2_get_byte(gb);
> switch(type) {
> 
> > +    case AMF_DATA_TYPE_NUMBER:      bytestream2_get_be64(gb); return 0;
> > +    case AMF_DATA_TYPE_BOOL:        bytestream2_get_byte(gb); return 0;
> > +    case AMF_DATA_TYPE_STRING:
> > +        bytestream2_skip(gb, bytestream2_get_be16(gb));
> > +        return 0;
> > +    case AMF_DATA_TYPE_LONG_STRING:
> > +        bytestream2_skip(gb, bytestream2_get_be32(gb));
> > +        return 0;
> > +    case AMF_DATA_TYPE_NULL:        return 0;
> > +    case AMF_DATA_TYPE_DATE:        bytestream2_skip(gb, 10); return 0;
> 
> Use separate lines for all the above or reorder them, for readability's
> sake.

changes made
applied

thanks

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I have never wished to cater to the crowd; for what I know they do not
approve, and what they approve I do not know. -- Epicurus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170729/d2f5833e/attachment.sig>