Fix NULL strcmp and misaligned load on malformed tracks - #101
Open
1820893135-pixel wants to merge 1 commit into
Open
Fix NULL strcmp and misaligned load on malformed tracks#1011820893135-pixel wants to merge 1 commit into
1820893135-pixel wants to merge 1 commit into
Conversation
Two related undefined behaviors when parsing malformed MP4 tracks: - MP4File::GenerateTracks() calls strcmp(pTypeProperty->GetValue(), MP4_HINT_TRACK_TYPE) without checking the handlerType string for NULL. A malformed trak/mdia/hdlr can leave the string property with a NULL value, so strcmp(NULL, ...) is UB (UBSan: null pointer passed as argument 1). Guard with a NULL check first. - STRTOINT32()/INT32TOSTR() dereference *(uint32_t*)s when MP4V2_INTSTRING_ALIGNMENT is not defined. Atom-type strings reached through ATOMID() are not guaranteed 4-byte aligned, so the cast is a misaligned load/store. Always copy through a local with memcpy(), matching the existing ARM-safe path. Fixes TechSmith#99.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the two undefined behaviors reported in #99.
1. NULL pointer passed to
strcmp(MP4File::GenerateTracks)A malformed
trak/mdia/hdlrcan leave thehandlerTypestring property with a NULL value, sostrcmp(NULL, ...)is UB. UBSan reportsnull pointer passed as argument 1, which is declared to never be null. Guard with a NULL check first:2. Misaligned load in
STRTOINT32/INT32TOSTRWhen
MP4V2_INTSTRING_ALIGNMENTis not defined,STRTOINT32dereferences*(uint32_t*)s. Atom-type strings reached throughATOMID()(e.g. inMP4Atom::ReadChildAtoms) are not guaranteed 4-byte aligned, so this is a misaligned load. The fix makes thememcpypath unconditional (it was already the ARM-safe path), avoiding the UB on all platforms:INT32TOSTRis made consistent (alwaysmemcpy).Verified: the reproducer from #99 triggers
null pointer passed as argument 1on the unfixed build; with this change it parses cleanly (exit 0, no sanitizer report) under-fsanitize=address,undefined -fno-sanitize-recover=all.Fixes #99.