Request 6572 (accepted)

Overview

Request 6572 (accepted)

Update to version 2.8.2.git20260824

Created by enzokiel 2 days ago
In state accepted

Submit avidemux3

Submit package home:enzokiel:...:home:enzokiel / avidemux3 to package home:enzokiel / avidemux3

avidemux3.changes Changed

avidemux3.spec Changed

avidemux2-2.8.2.git20260820.tar.xz/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4.cpp -> avidemux2-2.8.2.git20260824.tar.xz/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4.cpp Changed

avidemux2-2.8.2.git20260820.tar.xz/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4Analyzer.cpp -> avidemux2-2.8.2.git20260824.tar.xz/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4Analyzer.cpp Changed

@@ -382,6 +382,22 @@
 }
 
 /**
+    \fn checkRemaning
+    \brief Check whether atom is large enough to avoid reading past the end.
+*/
+static bool checkRemaining(adm_atom *tom, uint64_t bytesNeeded)
+{
+    int64_t bytesLeft = tom->getRemainingSize();
+    if (bytesLeft < bytesNeeded)
+    {
+        ADM_warning("Atom too small, need: %" PRId64", left: %" PRId64", damaged file?\n", bytesNeeded, bytesLeft);
+        tom->skipAtom();
+        return false;
+    }
+    return true;
+}
+
+/**
     \fn parseTrex
     \brief Some iso5 files specify dts increment via trex box only.
 */
@@ -716,13 +732,32 @@
     uint32_t playbackSpeed;
     int version=tom->read();
     tom->skipBytes(3);
-    uint32_t nb=tom->read32();
+    uint32_t nb, realNb = tom->read32();
+    const int maxElst = 2;
+
+    ADM_info("Found %" PRIu32" entries in edit list of version %d\n", realNb, version);
+
+    if (!realNb)
+    {
+        ADM_warning("Invalid empty elst.\n");
+        return 0;
+    }
+    if (realNb > maxElst)
+    {
+        ADM_warning("Edit lists with more than %d entries are ignored.\n", maxElst);
+        return 0;
+    }
+
+    if (realNb > maxElst)
+        nb = maxElst;
+    else
+        nb = realNb;
+
     int64_t *editDuration=new int64_tnb;
     int64_t *mediaTime=new int64_tnb;
     int64_t dlay=0;
     int64_t adv=0;
-    
-    ADM_info("ELST Found %" PRIu32" entries in list, version=%d\n",nb,version);
+
     for(int i=0;i<nb;i++)
     {
         if(1==version)
@@ -734,8 +769,8 @@
             editDurationi=(int32_t)tom->read32();
             mediaTimei=(int32_t)tom->read32();
         }
-            playbackSpeed=tom->read32();
-            ADM_info("Duration : %d, mediaTime:%d speed=%d \n",(int)editDurationi,(int)mediaTimei,(int)playbackSpeed);
+        playbackSpeed = tom->read32();
+        ADM_info("Duration: %" PRId64", mediaTime: %" PRId64", speed: %" PRIu32"\n", editDurationi, mediaTimei, playbackSpeed);
     }
 
     switch(nb)
@@ -875,8 +910,18 @@
         tom->skipAtom();
         return;
     }
+    if(info->nbSz && info->nbSync > info->nbSz)
+    {
+        ADM_warning("# of sync samples %" PRIu32" exceeds # of frames %" PRIu32", damaged file?\n", info->nbSync, info->nbSz);
+        tom->skipAtom();
+        return;
+    }
+
+    if (!checkRemaining(tom, info->nbSync * sizeof(uint32_t)))
+        return;
+
     info->Sync = new uint32_tinfo->nbSync;
-    for(int i=0; i < info->nbSync; i++)
+    for(uint32_t i = 0; i < info->nbSync; i++)
     {
         info->Synci = tom->read32();
     }
@@ -903,13 +948,21 @@
         tom->skipAtom();
         return;
     }
+    if (info->nbSz && info->nbStts > info->nbSz)
+    {
+        ADM_warning("# of entries in stts exceeds # of frames: %" PRIu32" vs %" PRIu32", damaged file?\n", info->nbStts, info->nbSz);
+    }
+
+    if (!checkRemaining(tom, info->nbStts * sizeof(uint32_t) * 2))
+        return;
+
     info->SttsN = new uint32_tinfo->nbStts;
     info->SttsC = new uint32_tinfo->nbStts;
-    for(int i=0; i < info->nbStts; i++)
+    for(uint32_t i = 0; i < info->nbStts; i++)
     {
         info->SttsNi = tom->read32();
         info->SttsCi = tom->read32();
-        aprintf("stts entry %d, count: %" PRIu32", unscaled size: %" PRIu32"\n", i, info->SttsNi, info->SttsCi);
+        aprintf("stts entry %" PRIu32", count: %" PRIu32", unscaled size: %" PRIu32"\n", i, info->SttsNi, info->SttsCi);
     }
     tom->skipAtom();
 }
@@ -934,14 +987,24 @@
         tom->skipAtom();
         return;
     }
+    if (info->nbSz && info->nbSc > info->nbSz)
+    {
+        ADM_warning("Chunk count %" PRIu32" exceeds # of frames %" PRIu32", damaged file?\n", info->nbSc, info->nbSz);
+        tom->skipAtom();
+        return;
+    }
+
+    if (!checkRemaining(tom, info->nbSc * sizeof(uint32_t) * 2))
+        return;
+
     info->Sc = new uint32_tinfo->nbSc;
     info->Sn = new uint32_tinfo->nbSc;
-    for(int i=0; i < info->nbSc; i++)
+    for(uint32_t i=0; i < info->nbSc; i++)
     {
         info->Sci = tom->read32();
         info->Sni = tom->read32();
         tom->read32(); // sample description ID
-        aprintf("stsc entry %d: first chunk: %" PRIu32", chunk count: %" PRIu32"\n", i, info->Sci, info->Sni);
+        aprintf("stsc entry %" PRIu32": first chunk: %" PRIu32", chunk count: %" PRIu32"\n", i, info->Sci, info->Sni);
     }
     tom->skipAtom();
 }
@@ -968,8 +1031,11 @@
         info->Sz = NULL;
     } else
     { // Frames of different size, read the table.
+        if (!checkRemaining(tom, info->nbSz * sizeof(uint32_t)))
+            return;
+
         info->Sz = new uint32_tinfo->nbSz;
-        for(int i=0; i < info->nbSz; i++)
+        for(uint32_t i = 0; i < info->nbSz; i++)
         {
             info->Szi = tom->read32();
         }
@@ -993,15 +1059,26 @@
     uint32_t n,i,j,k;
 
     n = tom->read32();
-    ADM_info("Found composition-time-to-sample atom (ctts) with %" PRIu32" entries.\n", info->nbSz);
+    ADM_info("Found composition-time-to-sample atom (ctts) with %" PRIu32" entries.\n", n);
     ADM_info("ctts version: %" PRIu32", flags: %" PRIu32"\n", fourbytes >> 6, fourbytes && 0xFFFFFF);
     if(n <= 1) // all the same or invalid, ignore
     {
         tom->skipAtom();
         return;
     }
+    if (info->nbSz && n > info->nbSz) // early validity check
+    {
+        ADM_warning("# of ctts entries %" PRIu32" exceeds # of frames %" PRIu32", damaged file?\n", n, info->nbSz);
+        tom->skipAtom();
+        return;
+    }
+
+    if (!checkRemaining(tom, n * sizeof(uint32_t) * 2))
+        return;
+
     uint32_t *values=new uint32_t n;
     uint32_t *count=new uint32_t n;
+    uint64_t sum = 0;
     for(i=0;i<n;i++)
     {
         counti = tom->read32();
@@ -1011,8 +1088,20 @@
             ADM_warning("Count at entry %" PRIu32" is equal zero, damaged file?\n", i);
             continue;
         }
-        info->nbCtts += counti;
+        sum += counti;
+        if (info->nbSz && sum > (uint64_t)info->nbSz)
+        {
+            ADM_error("Total count at entry %" PRIu32" exceeds number of frames %" PRIu32", damaged file?\n", i, info->nbSz);
+            sum = 0;
+            break;
+        } else if (sum > UINT32_MAX)
+        {
+            ADM_error("Total count exceeds UINT32_MAX, damaged file?\n");
+            sum = 0;
+            break;
+        }
     }
+    info->nbCtts = sum & 0xFFFFFFFF;
     if (!info->nbCtts)
     {
         ADM_warning("Invalid ctts.\n");
@@ -1061,6 +1150,16 @@
         tom->skipAtom();
         return;
     }
+    if (info->nbSz && info->nbCo > info->nbSz)
+    {
+        ADM_warning("# of chunk offsets %" PRIu32" exceeds # of frames %" PRIu32", damaged file?\n", info->nbCo, info->nbSz);
+        tom->skipAtom();
+        return;
+    }
+
+    if (!checkRemaining(tom, info->nbCo * sizeof(uint32_t)))
+        return;
+
     info->Co = new uint64_tinfo->nbCo;
     for(i = 0; i < info->nbCo; i++)
     {
@@ -1093,6 +1192,16 @@
         tom->skipAtom();
         return;
     }
+    if (info->nbSz && info->nbCo > info->nbSz)
+    {
+        ADM_warning("# of chunk offsets %" PRIu32" exceeds # of frames %" PRIu32", damaged file?\n", info->nbCo, info->nbSz);
+        tom->skipAtom();
+        return;
+    }
+
+    if (!checkRemaining(tom, info->nbCo * sizeof(uint64_t)))
+        return;
+
     info->Co = new uint64_tinfo->nbCo;
     for(i = 0; i < info->nbCo; i++)
     {

avidemux2-2.8.2.git20260820.tar.xz/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4Indexer.cpp -> avidemux2-2.8.2.git20260824.tar.xz/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4Indexer.cpp Changed

@@ -331,17 +331,33 @@
     }
     // if no sample to chunk we map directly
     // first build the # of sample per chunk table
-    uint32_t totalchunk=0;
+    uint64_t totalchunk=0;
 
     // Search the maximum
     if(info->nbSc)
     {
+        int64_t s = 0;
         for(i=0;i<info->nbSc-1;i++)
-            totalchunk+=(info->Sci+1-info->Sci)*info->Sni;
+        {
+            s = info->Sci+1;
+            s -= info->Sci;
+            s *= info->Sni;
+            totalchunk += s;
+        }
+        s = info->nbCo + 1;
+        s -= info->Scinfo->nbSc - 1;
+        s *= info->Sninfo->nbSc - 1;
+        totalchunk += s;
+    }
+    aprintf("# of chunks: %" PRIu32", max # of samples: %" PRId64"\n", info->nbCo, totalchunk);
 
-        totalchunk+=(info->nbCo-info->Scinfo->nbSc-1+1)*info->Sninfo->nbSc-1;
+    if (totalchunk > info->nbSz)
+    {
+        ADM_warning("# of data chunks %" PRId64" exceeds # of frames %" PRIu32", damaged file?\n", totalchunk, info->nbSz);
+        delete  track->index;
+        track->index = NULL;
+        return 0;
     }
-    aprintf("# of chunks %d, max # of samples %d\n",info->nbCo, totalchunk);
 
     uint32_t *chunkCount = new uint32_ttotalchunk+1;
 #if 0
@@ -359,14 +375,18 @@
     {
         for(i=0;i<info->nbSc-1;i++)
         {
-            int mn=info->Sci-1;
-            int mx=info->Sci+1-1;
-            if(mn<0 || mx<0 || mn>totalchunk || mx > totalchunk || mx<mn)
+            uint32_t mn = info->Sci;
+            uint32_t mx = info->Sci+1;
+            if(!mn || !mx || mn >= totalchunk || mx >= totalchunk || mx < mn)
             {
                 ADM_warning("Corrupted file\n");
+                delete  chunkCount;
+                chunkCount = NULL;
+                delete  track->index;
+                track->index = NULL;
                 return false;
             }
-            for(j=mn;j<mx;j++)
+            for(j = mn - 1; j < mx - 1; j++)
             {
                 chunkCountj=info->Sni;
                 ADM_assert(j<=totalchunk);
@@ -390,6 +410,7 @@
         aprintf("--starting at %lu , %lu to go\n",info->Coj,chunkCountj);
         for(uint32_t k=0;k<chunkCountj;k++)
         {
+            ADM_assert(cur < totalchunk);
             track->indexcur.offset=info->Coj+tail;
             tail+=track->indexcur.size;
             aprintf(" sample : %d offset : %lu\n",cur,track->indexcur.offset);
@@ -398,6 +419,7 @@
         }
     }
     delete  chunkCount;
+    chunkCount = NULL;
     track->nbIndex=cur;
 
     // Now deal with duration

Build Results
RPM Lint

Refresh

Comments for request 6572 0

Request History

enzokiel created request 2 days ago

Update to version 2.8.2.git20260824

enzokiel accepted request 2 days ago