Mercurial > hg > nginx
annotate src/os/unix/ngx_sunpro_sparc64.il @ 9322:d6f75dd66761 default tip
Mp4: added and updated sanity checks for "end" handling.
When handling incorrect data in ngx_http_mp4_crop_stsc_data(),
trak->end_chunk_samples might end up being arbitrary large, leading
to reading before the buffer in ngx_http_mp4_update_stsz_atom(). Fix
is to check that trak->end_chunk_samples corresponds to a memory within
the stsz atom data. For consistency, trak->start_chunk_samples
is checked similarly.
Similarly, trak->end_chunk might end up being smaller than trak->start_chunk,
leading to reading memory after the buffer in ngx_http_mp4_update_stco_atom()
and ngx_http_mp4_update_co64_atom(). Corresponding checks are updated
to explicitly test (trak->end_chunk - trak->start_chunk) instead of just
checking trak->end_chunk and assuming it is larger than trak->start_chunk.
This is generally in line with existing checks of
(trak->end_sample - trak->start_sample) in ngx_http_mp4_update_stsz_atom(),
where trak->end_sample might also become smaller than trak->start_sample
when handling incorrect data in ngx_http_mp4_crop_stts_data().
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Sun, 25 Aug 2024 06:35:40 +0300 |
parents | d620f497c50f |
children |
rev | line source |
---|---|
561 | 1 / |
2 / Copyright (C) Igor Sysoev | |
4412 | 3 / Copyright (C) Nginx, Inc. |
561 | 4 / |
5 | |
6 | |
7 / "casa [%o2] 0x80, %o1, %o0" and | |
8 / "casxa [%o2] 0x80, %o1, %o0" do the following: | |
577 | 9 / |
561 | 10 / if ([%o2] == %o1) { |
11 / swap(%o0, [%o2]); | |
12 / } else { | |
13 / %o0 = [%o2]; | |
14 / } | |
15 | |
16 | |
17 / ngx_atomic_uint_t ngx_casa(ngx_atomic_uint_t set, ngx_atomic_uint_t old, | |
18 / ngx_atomic_t *lock); | |
19 / | |
20 / the arguments are passed in the %o0, %o1, %o2 | |
21 / the result is returned in the %o0 | |
22 | |
23 .inline ngx_casa,0 | |
24 casa [%o2] 0x80, %o1, %o0 | |
25 .end | |
26 | |
27 | |
28 / ngx_atomic_uint_t ngx_casxa(ngx_atomic_uint_t set, ngx_atomic_uint_t old, | |
29 / ngx_atomic_t *lock); | |
30 / | |
31 / the arguments are passed in the %o0, %o1, %o2 | |
32 / the result is returned in the %o0 | |
33 | |
34 .inline ngx_casxa,0 | |
35 casxa [%o2] 0x80, %o1, %o0 | |
36 .end |