[FFmpeg-devel] [PATCH 1/2] avcodec/alacdsp: Make intermediates unsigned

[FFmpeg-devel] [PATCH 1/2] avcodec/alacdsp: Make intermediates unsigned

[Michael Niedermayer]

Fixes: signed integer overflow: -14914387 + -2147418648 cannot be represented in type 'int'
Fixes: 46464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-474307197311385

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/alacdsp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/alacdsp.c b/libavcodec/alacdsp.c
index 8718d1b6b1..b3c1c424f3 100644
--- a/libavcodec/alacdsp.c
+++ b/libavcodec/alacdsp.c
@@ -29,12 +29,12 @@ static void decorrelate_stereo(int32_t *buffer[2], int nb_samples,
     int i;
 
     for (i = 0; i < nb_samples; i++) {
-        int32_t a, b;
+        uint32_t a, b;
 
         a = buffer[0][i];
         b = buffer[1][i];
 
-        a -= (int)(b * (unsigned)decorr_left_weight) >> decorr_shift;
+        a -= (int)(b * decorr_left_weight) >> decorr_shift;
         b += a;
 
         buffer[0][i] = b;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avcodec/mpeg4videodec: Check pixel size against packet size

[Michael Niedermayer]

Fixes: Timeout
Fixes: 46866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5114397204283392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/mpeg4videodec.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index e2bde73639..267a79a62f 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -2337,8 +2337,14 @@ static int decode_studio_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
         /* Do the same check as non-studio profile */
         if (width && height) {
             if (s->width && s->height &&
-                (s->width != width || s->height != height))
+                (s->width != width || s->height != height)) {
+                if (width*height / 256 > get_bits_left(gb)) {
+                    av_log(s->avctx, AV_LOG_ERROR, "Impossible size for this frame\n");
+                    return AVERROR_INVALIDDATA;
+                }
+
                 s->context_reinit = 1;
+            }
             s->width  = width;
             s->height = height;
         }
@@ -2485,8 +2491,13 @@ static int decode_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
             if (width && height &&  /* they should be non zero but who knows */
                 !(s->width && s->codec_tag == AV_RL32("MP4S"))) {
                 if (s->width && s->height &&
-                    (s->width != width || s->height != height))
+                    (s->width != width || s->height != height)) {
+                    if (width*height/256 > get_bits_left(gb)) {
+                        av_log(s->avctx, AV_LOG_ERROR, "Impossible size for this frame\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     s->context_reinit = 1;
+                }
                 s->width  = width;
                 s->height = height;
             }
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/alacdsp: Make intermediates unsigned

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 831 bytes --]

On Fri, Apr 29, 2022 at 08:24:09PM +0200, Michael Niedermayer wrote:
> Fixes: signed integer overflow: -14914387 + -2147418648 cannot be represented in type 'int'
> Fixes: 46464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-474307197311385
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/alacdsp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you fake or manipulate statistics in a paper in physics you will never
get a job again.
If you fake or manipulate statistics in a paper in medicin you will get
a job for life at the pharma industry.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".