generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

rtmp: fix buffer overflows in ff_amf_tag_contents()

Browse Source 
A negative `size' will bypass FFMIN().  In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.

Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e692374f7962ea358c329de38c380103f8991b6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Xi Wang 2013-01-22 21:40:05 -05:00 committed by Michael Niedermayer
parent dd64626022
commit 3fb1a6c702
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavformat/rtmppkt.c
View File

@ -365,7 +365,7 @@ static const char* rtmp_packet_type(int type)
static void ff_amf_tag_contents(void *ctx, const uint8_t *data, const uint8_t *data_end) static void ff_amf_tag_contents(void *ctx, const uint8_t *data, const uint8_t *data_end)
{ {
int size; unsigned int size;
char buf[1024]; char buf[1024];
if (data >= data_end) if (data >= data_end)
@ -384,7 +384,7 @@ static void ff_amf_tag_contents(void *ctx, const uint8_t *data, const uint8_t *d
} else { } else {
size = bytestream_get_be32(&data); size = bytestream_get_be32(&data);
} }
size = FFMIN(size, 1023); size = FFMIN(size, sizeof(buf) - 1);
memcpy(buf, data, size); memcpy(buf, data, size);
buf[size] = 0; buf[size] = 0;
av_log(ctx, AV_LOG_DEBUG, " string '%s'\n", buf); av_log(ctx, AV_LOG_DEBUG, " string '%s'\n", buf);
@ -397,16 +397,15 @@ static void ff_amf_tag_contents(void *ctx, const uint8_t *data, const uint8_t *d
case AMF_DATA_TYPE_OBJECT: case AMF_DATA_TYPE_OBJECT:
av_log(ctx, AV_LOG_DEBUG, " {\n"); av_log(ctx, AV_LOG_DEBUG, " {\n");
for (;;) { for (;;) {
int size = bytestream_get_be16(&data);
int t; int t;
memcpy(buf, data, size); size = bytestream_get_be16(&data);
buf[size] = 0; av_strlcpy(buf, data, FFMIN(sizeof(buf), size + 1));
if (!size) { if (!size) {
av_log(ctx, AV_LOG_DEBUG, " }\n"); av_log(ctx, AV_LOG_DEBUG, " }\n");
data++; data++;
break; break;
} }
if (size < 0 || size >= data_end - data) if (size >= data_end - data)
return; return;
data += size; data += size;
av_log(ctx, AV_LOG_DEBUG, " %s: ", buf); av_log(ctx, AV_LOG_DEBUG, " %s: ", buf);