Mercurial > hg > nginx
view src/event/quic/bpf/bpfgen.sh @ 9322:d6f75dd66761 default tip
Mp4: added and updated sanity checks for "end" handling.
When handling incorrect data in ngx_http_mp4_crop_stsc_data(),
trak->end_chunk_samples might end up being arbitrary large, leading
to reading before the buffer in ngx_http_mp4_update_stsz_atom(). Fix
is to check that trak->end_chunk_samples corresponds to a memory within
the stsz atom data. For consistency, trak->start_chunk_samples
is checked similarly.
Similarly, trak->end_chunk might end up being smaller than trak->start_chunk,
leading to reading memory after the buffer in ngx_http_mp4_update_stco_atom()
and ngx_http_mp4_update_co64_atom(). Corresponding checks are updated
to explicitly test (trak->end_chunk - trak->start_chunk) instead of just
checking trak->end_chunk and assuming it is larger than trak->start_chunk.
This is generally in line with existing checks of
(trak->end_sample - trak->start_sample) in ngx_http_mp4_update_stsz_atom(),
where trak->end_sample might also become smaller than trak->start_sample
when handling incorrect data in ngx_http_mp4_crop_stts_data().
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Sun, 25 Aug 2024 06:35:40 +0300 |
parents | 7df607cb2d11 |
children |
line wrap: on
line source
#!/bin/bash export LANG=C set -e if [ $# -lt 1 ]; then echo "Usage: PROGNAME=foo LICENSE=bar $0 <bpf object file>" exit 1 fi self=$0 filename=$1 funcname=$PROGNAME generate_head() { cat << END /* AUTO-GENERATED, DO NOT EDIT. */ #include <stddef.h> #include <stdint.h> #include "ngx_bpf.h" END } generate_tail() { cat << END ngx_bpf_program_t $PROGNAME = { .relocs = bpf_reloc_prog_$funcname, .nrelocs = sizeof(bpf_reloc_prog_$funcname) / sizeof(bpf_reloc_prog_$funcname[0]), .ins = bpf_insn_prog_$funcname, .nins = sizeof(bpf_insn_prog_$funcname) / sizeof(bpf_insn_prog_$funcname[0]), .license = "$LICENSE", .type = BPF_PROG_TYPE_SK_REUSEPORT, }; END } process_relocations() { echo "static ngx_bpf_reloc_t bpf_reloc_prog_$funcname[] = {" objdump -r $filename | awk '{ if (enabled && $NF > 0) { off = strtonum(sprintf("0x%s", $1)); name = $3; printf(" { \"%s\", %d },\n", name, off/8); } if ($1 == "OFFSET") { enabled=1; } }' echo "};" echo } process_section() { echo "static struct bpf_insn bpf_insn_prog_$funcname[] = {" echo " /* opcode dst src offset imm */" section_info=$(objdump -h $filename --section=$funcname | grep "1 $funcname") # dd doesn't know hex length=$(printf "%d" 0x$(echo $section_info | cut -d ' ' -f3)) offset=$(printf "%d" 0x$(echo $section_info | cut -d ' ' -f6)) for ins in $(dd if="$filename" bs=1 count=$length skip=$offset status=none | xxd -p -c 8) do opcode=0x${ins:0:2} srcdst=0x${ins:2:2} # bytes are dumped in LE order offset=0x${ins:6:2}${ins:4:2} # short immedi=0x${ins:14:2}${ins:12:2}${ins:10:2}${ins:8:2} # int dst="$(($srcdst & 0xF))" src="$(($srcdst & 0xF0))" src="$(($src >> 4))" opcode=$(printf "0x%x" $opcode) dst=$(printf "BPF_REG_%d" $dst) src=$(printf "BPF_REG_%d" $src) offset=$(printf "%d" $offset) immedi=$(printf "0x%x" $immedi) printf " { %4s, %11s, %11s, (int16_t) %6s, %10s },\n" $opcode $dst $src $offset $immedi done cat << END }; END } generate_head process_relocations process_section generate_tail