From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 83F0244A12 for ; Thu, 29 Sep 2022 21:59:29 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id A0D4568BB25; Fri, 30 Sep 2022 00:59:26 +0300 (EEST) Received: from relay10.mail.gandi.net (relay10.mail.gandi.net [217.70.178.230]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 570BB68B1B5 for ; Fri, 30 Sep 2022 00:59:20 +0300 (EEST) Received: (Authenticated sender: michael@niedermayer.cc) by mail.gandi.net (Postfix) with ESMTPSA id 93DEC240006 for ; Thu, 29 Sep 2022 21:59:19 +0000 (UTC) Date: Thu, 29 Sep 2022 23:59:18 +0200 From: Michael Niedermayer To: ffmpeg-devel@ffmpeg.org Message-ID: <20220929215918.GB2046395@pb2> References: <20220918132124.3232741049C@natalya.videolan.org> MIME-Version: 1.0 In-Reply-To: <20220918132124.3232741049C@natalya.videolan.org> Subject: Re: [FFmpeg-devel] [FFmpeg-cvslog] avcodec/mlpdec: relax channels checking X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============7582849854669630679==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============7582849854669630679== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="dTy3Mrz/UPE2dbVg" Content-Disposition: inline --dTy3Mrz/UPE2dbVg Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Sep 18, 2022 at 01:21:23PM +0000, Paul B Mahol wrote: > ffmpeg | branch: master | Paul B Mahol | Sat Sep 17 14= :08:58 2022 +0200| [adaa06581c5444c94eef72d61b8166f096e2687a] | committer: = Paul B Mahol >=20 > avcodec/mlpdec: relax channels checking >=20 > Internal TrueHD decoder channel rematrix can mix 2 stereo substreams > into single mono stream. >=20 > Fixes #1726 >=20 > > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=3Dcommit;h=3Dadaa06581= c5444c94eef72d61b8166f096e2687a > --- >=20 > libavcodec/mlpdec.c | 23 +---------------------- > 1 file changed, 1 insertion(+), 22 deletions(-) This produces out of array accesses Also this was never posted to the mailing list. Simply removing checks is n= ot a solution, how can that even be a solution ?! please make sure you post all patches especially ones thats have not been t= ested very well to the mailing list thx =3D=3D764=3D=3DERROR: AddressSanitizer: heap-buffer-overflow on address 0x6= 2700000365c at pc 0x000000571644 bp 0x7ffe8bba5f60 sp 0x7ffe8bba5f58 READ of size 4 at 0x62700000365c thread T0 SCARINESS: 27 (4-byte-read-heap-buffer-overflow-far-from-bounds) #0 0x571643 in ff_mlp_pack_output /src/ffmpeg/libavcodec/mlpdsp.c:116:30 #1 0x56f95f in output_data /src/ffmpeg/libavcodec/mlpdec.c:1126:30 #2 0x56bee8 in read_access_unit /src/ffmpeg/libavcodec/mlpdec.c:1354:16 #3 0x51f46a in decode_simple_internal /src/ffmpeg/libavcodec/decode.c:3= 07:15 #4 0x51f46a in decode_simple_receive_frame /src/ffmpeg/libavcodec/decod= e.c:563:15 #5 0x51f46a in decode_receive_frame_internal /src/ffmpeg/libavcodec/dec= ode.c:584:15 #6 0x51ea5d in avcodec_send_packet /src/ffmpeg/libavcodec/decode.c:665:= 15 #7 0x5054ab in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dec_fuzz= er.c:510:25 #8 0xd9ec9a in ExecuteFilesOnyByOne aflplusplus/utils/aflpp_driver/aflp= p_driver.c:234:7 #9 0xd9ea6c in main aflplusplus/utils/aflpp_driver/aflpp_driver.c:318:12 #10 0x7f5a5cfd90b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/= csu/libc-start.c:308:16 #11 0x442f0d in _start 0x62700000365c is located 28 bytes to the right of 13632-byte region [0x627= 000000100,0x627000003640) allocated by thread T0 here: #0 0x4c4e97 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/as= an_malloc_linux.cpp:145:3 #1 0xcebcb1 in av_malloc /src/ffmpeg/libavutil/mem.c:105:9 #2 0xcebcb1 in av_mallocz /src/ffmpeg/libavutil/mem.c:266:17 #3 0x57270b in init_context_defaults /src/ffmpeg/libavcodec/options.c:1= 29:24 #4 0x57270b in avcodec_alloc_context3 /src/ffmpeg/libavcodec/options.c:= 156:9 #5 0x502963 in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dec_fuzz= er.c:311:27 #6 0xd9ec9a in ExecuteFilesOnyByOne aflplusplus/utils/aflpp_driver/aflp= p_driver.c:234:7 SUMMARY: AddressSanitizer: heap-buffer-overflow (/mnt/scratch0/clusterfuzz/= bot/builds/clusterfuzz-builds-afl_ffmpeg_bbf927d7e4cde0b71897048111a2d684e4= 8dfab7/revisions/ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer+0x571643) Shadow bytes around the buggy address: 0x0c4e7fff8670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff8680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff8690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff86a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff86b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =3D>0x0c4e7fff86c0: 00 00 00 00 00 00 00 00 fa fa fa[fa]fa fa fa fa 0x0c4e7fff86d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff86e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff86f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff8700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff8710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb =3D=3D764=3D=3DABORTING [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Awnsering whenever a program halts or runs forever is On a turing machine, in general impossible (turings halting problem). On any real computer, always possible as a real computer has a finite number of states N, and will either halt in less than N cycles or never halt. --dTy3Mrz/UPE2dbVg Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCYzYVMQAKCRBhHseHBAsP q8HrAJ9baOoJ6/1yZuamEv1572avmK2EggCgjVDQsKNuFkiDroge2AvzhBnLNXA= =1LD1 -----END PGP SIGNATURE----- --dTy3Mrz/UPE2dbVg-- --===============7582849854669630679== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============7582849854669630679==--