From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 750D1409B7 for ; Fri, 24 Dec 2021 20:30:02 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 81B7E68B002; Fri, 24 Dec 2021 22:29:59 +0200 (EET) Received: from mail.personalprojects.net (unknown [51.79.67.80]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6879368AFF1 for ; Fri, 24 Dec 2021 22:29:53 +0200 (EET) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=personalprojects.net; s=20211201; h=Content-Transfer-Encoding:Content-Type: In-Reply-To:From:References:To:Subject:MIME-Version:Date:Message-ID:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=ChUcV9g7J+s5ven1xfclvwKCfkbD6fUB1J+uKsi41cA=; b=Zr75q0eeksIdNoPhIPzB5tdQJR qp56LwERuXMIZwTT0lscN/6yBjTOhPuBcE6qGNz4vY6yWFtkyFXuDvD8t164KNrYi6k7iIO1DJhIs 3gbJ0POuEY3pT8CKvsgWEs6jllpk5NPLsxQWuRvvhkEpecuYZUOSkbIDNUcvT+IgjOAQ=; Received: from bras-base-simcon3012w-grc-05-64-231-188-105.dsl.bell.ca ([64.231.188.105] helo=[192.168.10.2]) by mail.personalprojects.net with esmtpsa (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1n0rCJ-0000vF-Dc for ffmpeg-devel@ffmpeg.org; Fri, 24 Dec 2021 15:29:51 -0500 Message-ID: <1884aaa4-e6f2-fc58-d2de-8fe92cd79ecf@personalprojects.net> Date: Fri, 24 Dec 2021 15:29:50 -0500 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.4.0 Content-Language: en-CA To: ffmpeg-devel@ffmpeg.org References: <20211223211527.20408-1-michael@niedermayer.cc> <20211223211527.20408-5-michael@niedermayer.cc> <08d87b86-6c41-5474-7303-9527cf6755cf@personalprojects.net> <20211224165800.GN2829255@pb2> From: John-Paul Stewart In-Reply-To: <20211224165800.GN2829255@pb2> Subject: Re: [FFmpeg-devel] [PATCH 5/5] avformat/mvdec: Check bytes_per_sample X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On 2021-12-24 11:58, Michael Niedermayer wrote: > On Thu, Dec 23, 2021 at 10:32:12PM -0500, John-Paul Stewart wrote: >> On 2021-12-23 16:15, Michael Niedermayer wrote: >>> Fixes: division by zero >>> Fixes: 42814/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-4787014237552640 >>> >>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg >>> Signed-off-by: Michael Niedermayer >>> --- >>> libavformat/mvdec.c | 3 +++ >>> 1 file changed, 3 insertions(+) >>> >>> diff --git a/libavformat/mvdec.c b/libavformat/mvdec.c >>> index 1a5012e5076..390f6ba4de8 100644 >>> --- a/libavformat/mvdec.c >>> +++ b/libavformat/mvdec.c >>> @@ -366,6 +366,9 @@ static int mv_read_header(AVFormatContext *avctx) >>> avpriv_request_sample(avctx, "Audio compression (format %i)", v); >>> } >>> >>> + if (bytes_per_sample <= 0) >>> + return AVERROR_INVALIDDATA; >>> + >> >> bytes_per_sample is uint32_t so it can never be less than zero. >> >> bytes_per_sample will be zero for movie files with no audio, so that is >> not necessarily invalid data. I have to retract that comment. Sorry for the confusion. Now that I've had time to delve into it further, the Silicon Graphics format will fill in a placeholder audio track (16 bit stereo, 22050 Hz) even when there is no actual audio. So even movies with no sound will have bytes_per_sample > 0. > i can change it to AVERROR_PATCHWELCOME but this codepath has already > created a audio stream so the code at least belives at this point that > there is audio and it will crash a few lines later > >> >> I can't offer a better suggestion at the moment, though. I'll see if >> can come up with something, unless one of you guys gets to it first. > > ok, ill apply this unless i see another fix first as it fixes the crash > and in fact in this path requests for samples where already printed also The real issue is that the audio stream is always allocated even when there is no audio. Fixing that is a project for another day. Don't let me stop you from applying the above patch. And again, my apologies for the confusion. _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".