From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id DF4F341A6B for ; Sat, 19 Mar 2022 17:38:19 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 15B3B68AE9E; Sat, 19 Mar 2022 19:38:17 +0200 (EET) Received: from relay11.mail.gandi.net (relay11.mail.gandi.net [217.70.178.231]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E37C7680588 for ; Sat, 19 Mar 2022 19:38:10 +0200 (EET) Received: from localhost (213-47-68-29.cable.dynamic.surfer.at [213.47.68.29]) (Authenticated sender: michael@niedermayer.cc) by mail.gandi.net (Postfix) with ESMTPSA id 5910A100002 for ; Sat, 19 Mar 2022 17:38:09 +0000 (UTC) Date: Sat, 19 Mar 2022 18:38:08 +0100 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20220319173808.GA2829255@pb2> References: <20220318174621.26974-1-michael@niedermayer.cc> MIME-Version: 1.0 In-Reply-To: Subject: Re: [FFmpeg-devel] [PATCH] avcodec/vp9_superframe_split_bsf: Check in size X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============5514849199497301960==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============5514849199497301960== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="Vq+LARK4eAgAjrKd" Content-Disposition: inline --Vq+LARK4eAgAjrKd Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Mar 18, 2022 at 06:56:19PM +0100, Andreas Rheinhardt wrote: > Michael Niedermayer: > > Fixes: Out of array read > > Fixes: 45137/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_SUPERFRAME_S= PLIT_fuzzer-4984270639202304 > >=20 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz= /tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer > > --- > > libavcodec/vp9_superframe_split_bsf.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > >=20 > > diff --git a/libavcodec/vp9_superframe_split_bsf.c b/libavcodec/vp9_sup= erframe_split_bsf.c > > index ed0444561a..481484a4f0 100644 > > --- a/libavcodec/vp9_superframe_split_bsf.c > > +++ b/libavcodec/vp9_superframe_split_bsf.c > > @@ -51,7 +51,7 @@ static int vp9_superframe_split_filter(AVBSFContext *= ctx, AVPacket *out) > > return ret; > > in =3D s->buffer_pkt; > > =20 > > - marker =3D in->data[in->size - 1]; > > + marker =3D in->size ? in->data[in->size - 1] : 0; > > if ((marker & 0xe0) =3D=3D 0xc0) { > > int length_size =3D 1 + ((marker >> 3) & 0x3); > > int nb_frames =3D 1 + (marker & 0x7); >=20 > There is a second place in this BSF where data might be read in the > absence of data, namely if one of the frames in a superframe have size > of zero (its attempted to read its profile; no actual read takes place > due to the checks of the get_bits API, but it is nevertheless invalid > data). See > https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200530160541.29517-7-= andreas.rheinhardt@gmail.com/; > also see > https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200530160541.29517-11= -andreas.rheinhardt@gmail.com/ > and > https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200530160541.29517-1-= andreas.rheinhardt@gmail.com/ Why did you not apply your bugfixes ? I think you should apply them thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB If you drop bombs on a foreign country and kill a hundred thousand innocent people, expect your government to call the consequence "unprovoked inhuman terrorist attacks" and use it to justify dropping more bombs and killing more people. The technology changed, the idea is old. --Vq+LARK4eAgAjrKd Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCYjYU/AAKCRBhHseHBAsP q98CAJ989VFRzkAcSnVlHZYgW7Qk8W8VIwCfSnnIu0IPedm59FpZCzHsB8Tp09w= =HQ0d -----END PGP SIGNATURE----- --Vq+LARK4eAgAjrKd-- --===============5514849199497301960== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============5514849199497301960==--