From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 31C494D04A for ; Fri, 7 Nov 2025 02:35:06 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'W1CNCiuREZnDNkmQr1aZbl5wpvfGdUDD9GrSZO+FqPQ=', expected b'bzBDK//oea2f+fVPWgf7SgUnkmDMhDJCCPpNniRFWas=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1762482890; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=W1CNCiuREZnDNkmQr1aZbl5wpvfGdUDD9GrSZO+FqPQ=; b=uB+BHjnLLyVtR7L5kSiKcYZVwZczGokkHiG4qDT7CDqq2b7ezKODzAuOEJb6XV/BsUNJp U2PUOsjKX6Q/+MQHahrYZ3wIchN/mR9qrFvMd64tHoemA84/eLw3Llv8VVcYVMZcYksNs7z tdBLC1HHPordVyoo257NXCArwm96HybFoMgCtFxirvOlu4aHQSkogGv2WbZgE4ojZT/gEZs fNf5zHwYQe99rm12dasD6AdLIrzv2OKglXIhwtiKHbEWhAoDXAbfq3PMIiBiYco/fgWlbrL O830/ebkESAyPjr+xDoibDZk7JpHlSpu0juxSo+mOPFGVvCLqJohERU3jngw== Received: from [172.19.0.2] (unknown [172.19.0.2]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 907B868FB8E; Fri, 7 Nov 2025 04:34:50 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1762482869; b=aFRO6whdQE1FAETDpt9pgtUBR+AujgaV5BESr0S7riCZszNx0OkZ2c9zX2qoVhIFarfky LG1gtIDQB3a3oLoo+CZu9NxijFBYy/4TtJHEl8p815J2tfeorLSsyFK+InSCDkruJf4U21C 5+CeY01R7UNBTulRtHjWf+9Bag+uIABZ9Q+b88Ck/XrQsB94+p8o69xv6JBCGpZkEiafehy bzJwN000dDNOjeOac4pWmtvUvPTzcroOy4MsRZ9hQ0d5HHHlEobbT6Zqsjf5wHgOcb6mVLK D6WF2P46rSsVra7wAUu+lyLjjuZd+AtK/pwklk8QHHKo3IBDoysKIhEnV21Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1762482869; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=qo0QTWm+gWDFEnhwK0wld80bPvKrJvdGj8R1WqdKSFg=; b=er8cU+qSiGBcdV7AEghsJw6C+W+i8G98adI8qARNf8hgUsmZ5jh/zgQ9MfgP2lCe5ByKR B2DSzhQohcn5nSlpD2Meq5H+mJkSm6Myzj36pYp8c8OdEQqLApEPxjNQKXbb7FLt954/eBd 3b6i2Mxhqgiuu5gwljAHcb0RvRunhwKZfwe6PGiXY1EEM7/6/QUfXxgRGIzUxMRHWVFBnkj G/l9uxOtgvw9SlgXQgxQhPT9ioqvkJRiMRjiTuuGdmrlp2DlD5XvBvfbGwjD7RzvKfs7b46 FsXvJsUlQH1wtkvzFtqd/apPaF/YxqgJvnTQ7thluw04bTW0NAUhMREx1fyQ== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1762482862; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=bzBDK//oea2f+fVPWgf7SgUnkmDMhDJCCPpNniRFWas=; b=EzGN5uIfj/XSIo7fOEyuR0r4Q4xFwV3v1hKXop1g3ml3AmwX0G+eghKHjr3u/zqc9LUTT bhsDQWofFEqWmpG8p6Q44s9s5Ut4WlYbWTZhvr5daO6kos68MjoXocrxFUsyFLv3Sf3dXaG ktDnE/oYVpBC9EFybUAjsgEK1qNjAFoIDJiAp31VZTWphSwe2tavIvZ5qvfkcofaAKafM1K gwEQdYVO+MWlA5gdJOZ2qXNH2a4ZTz/CcShGDungu5rvdXLeco2+ZxaJ38wDxR/x8X8JBIL 159ICICr4wqsb4VKOKw3Ero8a5LkpcPbSHtjfDPT/1k4JJc8i3q2VmsRsglw== Received: from 188d6d40ca7a (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 5C5E368EF13 for ; Fri, 7 Nov 2025 04:34:22 +0200 (EET) MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Fri, 07 Nov 2025 02:34:21 -0000 Message-ID: <176248286253.25.3916061702889594820@2cb04c0e5124> Message-ID-Hash: 6IJL7UEORHSQXGARJOUNFD5RD35NDGQX X-Message-ID-Hash: 6IJL7UEORHSQXGARJOUNFD5RD35NDGQX X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PATCH] avcodec/prores_raw: Check get_value() return code (PR #20855) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: michaelni via ffmpeg-devel Cc: michaelni Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #20855 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20855 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20855.patch >>From 5ccb2c9934615db1d55a7a62dda551c4d02c6fd6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 7 Nov 2025 01:47:40 +0100 Subject: [PATCH 1/3] avcodec/prores_raw: Prettify ff_prores_raw_*_cb the values contain 3 4 bit values, thus using hex is more natural and shows more information Signed-off-by: Michael Niedermayer --- libavcodec/prores_raw.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c index 0298956efd..f293e489bc 100644 --- a/libavcodec/prores_raw.c +++ b/libavcodec/prores_raw.c @@ -101,30 +101,30 @@ static const uint8_t align_tile_w[16] = { #define DC_CB_MAX 12 const uint8_t ff_prores_raw_dc_cb[DC_CB_MAX + 1] = { - 16, 33, 50, 51, 51, 51, 68, 68, 68, 68, 68, 68, 118, + 0x010, 0x021, 0x032, 0x033, 0x033, 0x033, 0x044, 0x044, 0x044, 0x044, 0x044, 0x044, 0x076, }; #define AC_CB_MAX 94 const int16_t ff_prores_raw_ac_cb[AC_CB_MAX + 1] = { - 0, 529, 273, 273, 546, 546, 546, 290, 290, 290, 563, 563, - 563, 563, 563, 563, 563, 563, 307, 307, 580, 580, 580, 580, - 580, 580, 580, 580, 580, 580, 580, 580, 580, 580, 580, 580, - 580, 580, 580, 580, 580, 580, 853, 853, 853, 853, 853, 853, - 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, - 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, - 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, - 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 358 + 0x000, 0x211, 0x111, 0x111, 0x222, 0x222, 0x222, 0x122, 0x122, 0x122, + 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x133, 0x133, + 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, + 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, + 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, + 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, + 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, + 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x166, }; #define RN_CB_MAX 27 const int16_t ff_prores_raw_rn_cb[RN_CB_MAX + 1] = { - 512, 256, 0, 0, 529, 529, 273, 273, 17, 17, 33, 33, 546, - 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, 50, 50, 68, + 0x200, 0x100, 0x000, 0x000, 0x211, 0x211, 0x111, 0x111, 0x011, 0x011, 0x021, 0x021, 0x222, 0x022, + 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x032, 0x032, 0x044 }; #define LN_CB_MAX 14 const int16_t ff_prores_raw_ln_cb[LN_CB_MAX + 1] = { - 256, 273, 546, 546, 290, 290, 1075, 1075, 563, 563, 563, 563, 563, 563, 51 + 0x100, 0x111, 0x222, 0x222, 0x122, 0x122, 0x433, 0x433, 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x033, }; static int decode_comp(AVCodecContext *avctx, TileContext *tile, -- 2.49.1 >>From 2620c7dc76234dc1e9d0ece586a607e680d82e76 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 7 Nov 2025 01:53:17 +0100 Subject: [PATCH 2/3] avcodec/prores_raw: Check bits in get_value() The code loads 32bit so we can at maximum use 32bit Fixes: runtime error: shift exponent -9 is negative Fixes: 439483046/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_RAW_DEC_fuzzer-6649466540326912 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/prores_raw.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c index f293e489bc..7d78a043b1 100644 --- a/libavcodec/prores_raw.c +++ b/libavcodec/prores_raw.c @@ -87,6 +87,8 @@ static int16_t get_value(GetBitContext *gb, int16_t codebook) } bits = exp_order + (q << 1) - switch_bits; + if (bits > 32) + return -1; skip_bits_long(gb, bits); return (b >> (32 - bits)) + ((switch_bits + 1) << rice_order) - -- 2.49.1 >>From 375a4fd43300674d9b251be203f38593215ca5c1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 7 Nov 2025 01:55:39 +0100 Subject: [PATCH 3/3] avcodec/prores_raw: Check get_value() return code Fixes: out of array access Fixes: 439483046/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_RAW_DEC_fuzzer-6649466540326912 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/prores_raw.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c index 7d78a043b1..ceee757420 100644 --- a/libavcodec/prores_raw.c +++ b/libavcodec/prores_raw.c @@ -171,6 +171,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, /* Special handling for first block */ int dc = get_value(&gb, 700); + if (dc < 0) + return AVERROR_INVALIDDATA; int prev_dc = (dc >> 1) ^ -(dc & 1); block[0] = (((dc&1) + (dc>>1) ^ -(int)(dc & 1)) + (dc & 1)) + 1; @@ -184,6 +186,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, dc_codebook = ff_prores_raw_dc_cb[FFMIN(TODCCODEBOOK(dc), DC_CB_MAX)]; dc = get_value(&gb, dc_codebook); + if (dc < 0) + break; sign = sign ^ dc & 1; dc_add = (-sign ^ TODCCODEBOOK(dc)) + sign; @@ -198,6 +202,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, break; ln = get_value(&gb, ln_codebook); + if (ln < 0) + break; for (int i = 0; i < ln; i++) { if (get_bits_left(&gb) <= 0) @@ -207,6 +213,9 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, break; ac = get_value(&gb, ac_codebook); + if (ac < 0) + break; + ac_codebook = ff_prores_raw_ac_cb[FFMIN(ac, AC_CB_MAX)]; sign = -get_bits1(&gb); @@ -219,6 +228,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, break; rn = get_value(&gb, rn_codebook); + if (rn < 0) + break; rn_codebook = ff_prores_raw_rn_cb[FFMIN(rn, RN_CB_MAX)]; n += rn + 1; @@ -229,6 +240,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, break; ac = get_value(&gb, ac_codebook); + if (ac < 0) + break; sign = -get_bits1(&gb); idx = scan[n >> log2_nb_blocks] + ((n & block_mask) << 6); -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org