[FFmpeg-devel] [PATCH 1/2] avutil/channel_layout: av_channel_layout_describe_bprint: Check for buffer end

[FFmpeg-devel] [PATCH 1/2] avutil/channel_layout: av_channel_layout_describe_bprint: Check for buffer end

[Michael Niedermayer]

Fixes: Timeout printing a billion channels
Fixes: 48099/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6754782204788736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavutil/channel_layout.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c
index 21b70173b7..72969eff14 100644
--- a/libavutil/channel_layout.c
+++ b/libavutil/channel_layout.c
@@ -757,6 +757,10 @@ int av_channel_layout_describe_bprint(const AVChannelLayout *channel_layout,
             if (channel_layout->order == AV_CHANNEL_ORDER_CUSTOM &&
                 channel_layout->u.map[i].name[0])
                 av_bprintf(bp, "@%s", channel_layout->u.map[i].name);
+
+            if (!av_bprint_is_complete(bp))
+                return AVERROR(EINVAL);
+
         }
         if (channel_layout->nb_channels) {
             av_bprintf(bp, ")");
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avcodec/tiff: Check pixel format types for dng

[Michael Niedermayer]

Fixes: out of array access
Fixes: 48271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6149705769287680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/tiff.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index e4a5d3c537..bf69b083b3 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -761,6 +761,7 @@ static int tiff_unpack_strip(TiffContext *s, AVFrame *p, uint8_t *dst, int strid
     if (s->is_bayer) {
         av_assert0(width == (s->bpp * s->width + 7) >> 3);
     }
+    av_assert0(!(s->is_bayer && is_yuv));
     if (p->format == AV_PIX_FMT_GRAY12) {
         av_fast_padded_malloc(&s->yuv_line, &s->yuv_line_size, width);
         if (s->yuv_line == NULL) {
@@ -844,6 +845,8 @@ static int tiff_unpack_strip(TiffContext *s, AVFrame *p, uint8_t *dst, int strid
             av_log(s->avctx, AV_LOG_ERROR, "More than one DNG JPEG strips unsupported\n");
             return AVERROR_PATCHWELCOME;
         }
+        if (!s->is_bayer)
+            return AVERROR_PATCHWELCOME;
         if ((ret = dng_decode_jpeg(s->avctx, p, s->stripsize, 0, 0, s->width, s->height)) < 0)
             return ret;
         return 0;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avutil/channel_layout: av_channel_layout_describe_bprint: Check for buffer end

[James Almer]

On 7/1/2022 4:25 PM, Michael Niedermayer wrote:
> Fixes: Timeout printing a billion channels
> Fixes: 48099/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6754782204788736
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavutil/channel_layout.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c
> index 21b70173b7..72969eff14 100644
> --- a/libavutil/channel_layout.c
> +++ b/libavutil/channel_layout.c
> @@ -757,6 +757,10 @@ int av_channel_layout_describe_bprint(const AVChannelLayout *channel_layout,
>               if (channel_layout->order == AV_CHANNEL_ORDER_CUSTOM &&
>                   channel_layout->u.map[i].name[0])
>                   av_bprintf(bp, "@%s", channel_layout->u.map[i].name);
> +
> +            if (!av_bprint_is_complete(bp))
> +                return AVERROR(EINVAL);

Should be ENOMEM.

LGTM with that change.

> +
>           }
>           if (channel_layout->nb_channels) {
>               av_bprintf(bp, ")");
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avutil/channel_layout: av_channel_layout_describe_bprint: Check for buffer end

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1488 bytes --]

On Fri, Jul 01, 2022 at 04:30:57PM -0300, James Almer wrote:
> On 7/1/2022 4:25 PM, Michael Niedermayer wrote:
> > Fixes: Timeout printing a billion channels
> > Fixes: 48099/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6754782204788736
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >   libavutil/channel_layout.c | 4 ++++
> >   1 file changed, 4 insertions(+)
> > 
> > diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c
> > index 21b70173b7..72969eff14 100644
> > --- a/libavutil/channel_layout.c
> > +++ b/libavutil/channel_layout.c
> > @@ -757,6 +757,10 @@ int av_channel_layout_describe_bprint(const AVChannelLayout *channel_layout,
> >               if (channel_layout->order == AV_CHANNEL_ORDER_CUSTOM &&
> >                   channel_layout->u.map[i].name[0])
> >                   av_bprintf(bp, "@%s", channel_layout->u.map[i].name);
> > +
> > +            if (!av_bprint_is_complete(bp))
> > +                return AVERROR(EINVAL);
> 
> Should be ENOMEM.
> 
> LGTM with that change.

will changa and apply

thx
[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Many things microsoft did are stupid, but not doing something just because
microsoft did it is even more stupid. If everything ms did were stupid they
would be bankrupt already.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/tiff: Check pixel format types for dng

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 627 bytes --]

On Fri, Jul 01, 2022 at 09:25:53PM +0200, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: 48271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6149705769287680
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/tiff.c | 3 +++
>  1 file changed, 3 insertions(+)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

In a rich man's house there is no place to spit but his face.
-- Diogenes of Sinope

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".