GNOME Bugzilla – Bug 778432
Crash on state chang to NULL during mp3_type_find_at_offset
Last modified: 2017-02-19 10:54:26 UTC
When changing state to NULL during mp3_type_find, assertion occurs due to unsigned int overflow. Variable "found" type is guint, but "found" value is changed to 4294967295 (0xffffffff) because the code that performs -1 without checking overflow. if (head_data == NULL && gst_type_find_peek (tf, offset + start_off - 1, 1) == NULL) /* Incomplete last frame - don't count it. */ found--; Therefore, probability value is calculated abnormally large and it occurs assert. guint probability = found * GST_TYPE_FIND_MAXIMUM * (GST_MP3_TYPEFIND_TRY_SYNC - skipped) / GST_MP3_TYPEFIND_TRY_HEADERS / GST_MP3_TYPEFIND_TRY_SYNC; ... g_assert (probability <= GST_TYPE_FIND_MAXIMUM);
Created attachment 345408 [details] [review] typefindfunctions: prevent unsigned int overflow
Review of attachment 345408 [details] [review]: ::: gst/typefind/gsttypefindfunctions.c @@ +1507,3 @@ } g_assert (found <= GST_MP3_TYPEFIND_TRY_HEADERS); + if (found > 0 && head_data == NULL && As you say, found is a guint... so checking for > 0 will always be TRUE
It is false when found = 0. It happen when found == 0.
Created attachment 345593 [details] [review] typefindfunctions: prevent unsigned int overflow Does it look more clear if the condition is changed as below? - if (found > 0 && head_data == NULL && + if (found != 0 && head_data == NULL && Assertion causes only when found == 0.
Attachment 345593 [details] pushed as 0889d89 - typefindfunctions: prevent unsigned int overflow