From: michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>
To: ffmpeg-devel@ffmpeg.org
Cc: michaelni <code@ffmpeg.org>
Subject: [FFmpeg-devel] [PATCH] avcodec/prores_raw: Check get_value() return code (PR #20855)
Date: Fri, 07 Nov 2025 02:34:21 -0000
Message-ID: <176248286253.25.3916061702889594820@2cb04c0e5124> (raw)
PR #20855 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20855
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20855.patch
>From 5ccb2c9934615db1d55a7a62dda551c4d02c6fd6 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 7 Nov 2025 01:47:40 +0100
Subject: [PATCH 1/3] avcodec/prores_raw: Prettify ff_prores_raw_*_cb
the values contain 3 4 bit values, thus using hex is more natural
and shows more information
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/prores_raw.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c
index 0298956efd..f293e489bc 100644
--- a/libavcodec/prores_raw.c
+++ b/libavcodec/prores_raw.c
@@ -101,30 +101,30 @@ static const uint8_t align_tile_w[16] = {
#define DC_CB_MAX 12
const uint8_t ff_prores_raw_dc_cb[DC_CB_MAX + 1] = {
- 16, 33, 50, 51, 51, 51, 68, 68, 68, 68, 68, 68, 118,
+ 0x010, 0x021, 0x032, 0x033, 0x033, 0x033, 0x044, 0x044, 0x044, 0x044, 0x044, 0x044, 0x076,
};
#define AC_CB_MAX 94
const int16_t ff_prores_raw_ac_cb[AC_CB_MAX + 1] = {
- 0, 529, 273, 273, 546, 546, 546, 290, 290, 290, 563, 563,
- 563, 563, 563, 563, 563, 563, 307, 307, 580, 580, 580, 580,
- 580, 580, 580, 580, 580, 580, 580, 580, 580, 580, 580, 580,
- 580, 580, 580, 580, 580, 580, 853, 853, 853, 853, 853, 853,
- 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853,
- 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853,
- 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853,
- 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 358
+ 0x000, 0x211, 0x111, 0x111, 0x222, 0x222, 0x222, 0x122, 0x122, 0x122,
+ 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x133, 0x133,
+ 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244,
+ 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244,
+ 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355,
+ 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355,
+ 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355,
+ 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x166,
};
#define RN_CB_MAX 27
const int16_t ff_prores_raw_rn_cb[RN_CB_MAX + 1] = {
- 512, 256, 0, 0, 529, 529, 273, 273, 17, 17, 33, 33, 546,
- 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, 50, 50, 68,
+ 0x200, 0x100, 0x000, 0x000, 0x211, 0x211, 0x111, 0x111, 0x011, 0x011, 0x021, 0x021, 0x222, 0x022,
+ 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x032, 0x032, 0x044
};
#define LN_CB_MAX 14
const int16_t ff_prores_raw_ln_cb[LN_CB_MAX + 1] = {
- 256, 273, 546, 546, 290, 290, 1075, 1075, 563, 563, 563, 563, 563, 563, 51
+ 0x100, 0x111, 0x222, 0x222, 0x122, 0x122, 0x433, 0x433, 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x033,
};
static int decode_comp(AVCodecContext *avctx, TileContext *tile,
--
2.49.1
>From 2620c7dc76234dc1e9d0ece586a607e680d82e76 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 7 Nov 2025 01:53:17 +0100
Subject: [PATCH 2/3] avcodec/prores_raw: Check bits in get_value()
The code loads 32bit so we can at maximum use 32bit
Fixes: runtime error: shift exponent -9 is negative
Fixes: 439483046/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_RAW_DEC_fuzzer-6649466540326912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/prores_raw.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c
index f293e489bc..7d78a043b1 100644
--- a/libavcodec/prores_raw.c
+++ b/libavcodec/prores_raw.c
@@ -87,6 +87,8 @@ static int16_t get_value(GetBitContext *gb, int16_t codebook)
}
bits = exp_order + (q << 1) - switch_bits;
+ if (bits > 32)
+ return -1;
skip_bits_long(gb, bits);
return (b >> (32 - bits)) +
((switch_bits + 1) << rice_order) -
--
2.49.1
>From 375a4fd43300674d9b251be203f38593215ca5c1 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 7 Nov 2025 01:55:39 +0100
Subject: [PATCH 3/3] avcodec/prores_raw: Check get_value() return code
Fixes: out of array access
Fixes: 439483046/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_RAW_DEC_fuzzer-6649466540326912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/prores_raw.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c
index 7d78a043b1..ceee757420 100644
--- a/libavcodec/prores_raw.c
+++ b/libavcodec/prores_raw.c
@@ -171,6 +171,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile,
/* Special handling for first block */
int dc = get_value(&gb, 700);
+ if (dc < 0)
+ return AVERROR_INVALIDDATA;
int prev_dc = (dc >> 1) ^ -(dc & 1);
block[0] = (((dc&1) + (dc>>1) ^ -(int)(dc & 1)) + (dc & 1)) + 1;
@@ -184,6 +186,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile,
dc_codebook = ff_prores_raw_dc_cb[FFMIN(TODCCODEBOOK(dc), DC_CB_MAX)];
dc = get_value(&gb, dc_codebook);
+ if (dc < 0)
+ break;
sign = sign ^ dc & 1;
dc_add = (-sign ^ TODCCODEBOOK(dc)) + sign;
@@ -198,6 +202,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile,
break;
ln = get_value(&gb, ln_codebook);
+ if (ln < 0)
+ break;
for (int i = 0; i < ln; i++) {
if (get_bits_left(&gb) <= 0)
@@ -207,6 +213,9 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile,
break;
ac = get_value(&gb, ac_codebook);
+ if (ac < 0)
+ break;
+
ac_codebook = ff_prores_raw_ac_cb[FFMIN(ac, AC_CB_MAX)];
sign = -get_bits1(&gb);
@@ -219,6 +228,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile,
break;
rn = get_value(&gb, rn_codebook);
+ if (rn < 0)
+ break;
rn_codebook = ff_prores_raw_rn_cb[FFMIN(rn, RN_CB_MAX)];
n += rn + 1;
@@ -229,6 +240,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile,
break;
ac = get_value(&gb, ac_codebook);
+ if (ac < 0)
+ break;
sign = -get_bits1(&gb);
idx = scan[n >> log2_nb_blocks] + ((n & block_mask) << 6);
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
reply other threads:[~2025-11-07 2:35 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=176248286253.25.3916061702889594820@2cb04c0e5124 \
--to=ffmpeg-devel@ffmpeg.org \
--cc=code@ffmpeg.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git