[FFmpeg-devel] [PATCH 1/4] avformat/matroskadec: Check duration

[FFmpeg-devel] [PATCH 1/4] avformat/matroskadec: Check duration

[Michael Niedermayer]

Fixes: -nan is outside the range of representable values of type 'long'
Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/matroskadec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 91f3567692..8f0c53a6bc 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -3065,6 +3065,8 @@ static int matroska_read_header(AVFormatContext *s)
 
     if (!matroska->time_scale)
         matroska->time_scale = 1000000;
+    if (isnan(matroska->duration))
+        matroska->duration = 0;
     if (matroska->duration)
         matroska->ctx->duration = matroska->duration * matroska->time_scale *
                                   1000 / AV_TIME_BASE;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/4] avcodec/movtextdec: add () to CMP() macro to avoid unexpected behavior

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/movtextdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c
index 825632ca9b..dc30fdc698 100644
--- a/libavcodec/movtextdec.c
+++ b/libavcodec/movtextdec.c
@@ -263,7 +263,7 @@ static int decode_hclr(const uint8_t *tsmb, MovTextContext *m, uint64_t size)
 
 static int styles_equivalent(const StyleBox *a, const StyleBox *b)
 {
-#define CMP(field) a->field == b->field
+#define CMP(field) ((a)->field == (b)->field)
     return CMP(bold)  && CMP(italic)   && CMP(underline) && CMP(color) &&
            CMP(alpha) && CMP(fontsize) && CMP(font_id);
 #undef CMP
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/4] avcodec/movtextdec: add () to CMP() macro to avoid unexpected behavior

[Andreas Rheinhardt]

Michael Niedermayer:
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/movtextdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c
> index 825632ca9b..dc30fdc698 100644
> --- a/libavcodec/movtextdec.c
> +++ b/libavcodec/movtextdec.c
> @@ -263,7 +263,7 @@ static int decode_hclr(const uint8_t *tsmb, MovTextContext *m, uint64_t size)
>  
>  static int styles_equivalent(const StyleBox *a, const StyleBox *b)
>  {
> -#define CMP(field) a->field == b->field
> +#define CMP(field) ((a)->field == (b)->field)
>      return CMP(bold)  && CMP(italic)   && CMP(underline) && CMP(color) &&
>             CMP(alpha) && CMP(fontsize) && CMP(font_id);
>  #undef CMP

LGTM.
(Did you find the issues in patches 2-4 by code inspection or by a
static analyzer?)

- Andreas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/4] avcodec/movtextdec: add () to CMP() macro to avoid unexpected behavior

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1189 bytes --]

On Mon, Feb 14, 2022 at 08:52:52PM +0100, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/movtextdec.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c
> > index 825632ca9b..dc30fdc698 100644
> > --- a/libavcodec/movtextdec.c
> > +++ b/libavcodec/movtextdec.c
> > @@ -263,7 +263,7 @@ static int decode_hclr(const uint8_t *tsmb, MovTextContext *m, uint64_t size)
> >  
> >  static int styles_equivalent(const StyleBox *a, const StyleBox *b)
> >  {
> > -#define CMP(field) a->field == b->field
> > +#define CMP(field) ((a)->field == (b)->field)
> >      return CMP(bold)  && CMP(italic)   && CMP(underline) && CMP(color) &&
> >             CMP(alpha) && CMP(fontsize) && CMP(font_id);
> >  #undef CMP
> 
> LGTM.
> (Did you find the issues in patches 2-4 by code inspection or by a
> static analyzer?)

some old grep commands

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

There will always be a question for which you do not know the correct answer.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/4] avcodec/movtextdec: add () to CMP() macro to avoid unexpected behavior

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1199 bytes --]

On Mon, Feb 14, 2022 at 08:52:52PM +0100, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/movtextdec.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c
> > index 825632ca9b..dc30fdc698 100644
> > --- a/libavcodec/movtextdec.c
> > +++ b/libavcodec/movtextdec.c
> > @@ -263,7 +263,7 @@ static int decode_hclr(const uint8_t *tsmb, MovTextContext *m, uint64_t size)
> >  
> >  static int styles_equivalent(const StyleBox *a, const StyleBox *b)
> >  {
> > -#define CMP(field) a->field == b->field
> > +#define CMP(field) ((a)->field == (b)->field)
> >      return CMP(bold)  && CMP(italic)   && CMP(underline) && CMP(color) &&
> >             CMP(alpha) && CMP(fontsize) && CMP(font_id);
> >  #undef CMP
> 
> LGTM.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Let us carefully observe those good qualities wherein our enemies excel us
and endeavor to excel them, by avoiding what is faulty, and imitating what
is excellent in them. -- Plutarch

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/4] avformat/argo_asf: Fix order of operations in error check in argo_asf_write_trailer()

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/argo_asf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/argo_asf.c b/libavformat/argo_asf.c
index 2b3569ebc3..d26844d1e2 100644
--- a/libavformat/argo_asf.c
+++ b/libavformat/argo_asf.c
@@ -423,7 +423,7 @@ static int argo_asf_write_trailer(AVFormatContext *s)
     ArgoASFMuxContext *ctx = s->priv_data;
     int64_t ret;
 
-    if ((ret = avio_seek(s->pb, ASF_FILE_HEADER_SIZE, SEEK_SET) < 0))
+    if ((ret = avio_seek(s->pb, ASF_FILE_HEADER_SIZE, SEEK_SET)) < 0)
         return ret;
 
     avio_wl32(s->pb, (uint32_t)ctx->nb_blocks);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avformat/argo_asf: Fix order of operations in error check in argo_asf_write_trailer()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 438 bytes --]

On Mon, Feb 14, 2022 at 08:39:33PM +0100, Michael Niedermayer wrote:
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/argo_asf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

"I am not trying to be anyone's saviour, I'm trying to think about the
 future and not be sad" - Elon Musk


[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/4] avformat/argo_cvg:: Fix order of operations in error check in argo_cvg_write_trailer()

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/argo_cvg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/argo_cvg.c b/libavformat/argo_cvg.c
index e1854b4493..c5da32536d 100644
--- a/libavformat/argo_cvg.c
+++ b/libavformat/argo_cvg.c
@@ -350,7 +350,7 @@ static int argo_cvg_write_trailer(AVFormatContext *s)
      */
     avio_wl32(s->pb, ctx->checksum);
 
-    if ((ret = avio_seek(s->pb, 0, SEEK_SET) < 0))
+    if ((ret = avio_seek(s->pb, 0, SEEK_SET)) < 0)
         return ret;
 
     avio_wl32(s->pb, (uint32_t)ctx->size);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 4/4] avformat/argo_cvg:: Fix order of operations in error check in argo_cvg_write_trailer()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 405 bytes --]

On Mon, Feb 14, 2022 at 08:39:34PM +0100, Michael Niedermayer wrote:
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/argo_cvg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

No great genius has ever existed without some touch of madness. -- Aristotle

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/4] avformat/matroskadec: Check duration

[Andreas Rheinhardt]

Michael Niedermayer:
> Fixes: -nan is outside the range of representable values of type 'long'
> Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/matroskadec.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
> index 91f3567692..8f0c53a6bc 100644
> --- a/libavformat/matroskadec.c
> +++ b/libavformat/matroskadec.c
> @@ -3065,6 +3065,8 @@ static int matroska_read_header(AVFormatContext *s)
>  
>      if (!matroska->time_scale)
>          matroska->time_scale = 1000000;
> +    if (isnan(matroska->duration))
> +        matroska->duration = 0;
>      if (matroska->duration)
>          matroska->ctx->duration = matroska->duration * matroska->time_scale *
>                                    1000 / AV_TIME_BASE;

LGTM.

- Andreas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/4] avformat/matroskadec: Check duration

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1484 bytes --]

On Mon, Feb 14, 2022 at 08:56:51PM +0100, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > Fixes: -nan is outside the range of representable values of type 'long'
> > Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/matroskadec.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
> > index 91f3567692..8f0c53a6bc 100644
> > --- a/libavformat/matroskadec.c
> > +++ b/libavformat/matroskadec.c
> > @@ -3065,6 +3065,8 @@ static int matroska_read_header(AVFormatContext *s)
> >  
> >      if (!matroska->time_scale)
> >          matroska->time_scale = 1000000;
> > +    if (isnan(matroska->duration))
> > +        matroska->duration = 0;
> >      if (matroska->duration)
> >          matroska->ctx->duration = matroska->duration * matroska->time_scale *
> >                                    1000 / AV_TIME_BASE;
> 
> LGTM.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you fake or manipulate statistics in a paper in physics you will never
get a job again.
If you fake or manipulate statistics in a paper in medicin you will get
a job for life at the pharma industry.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".