* [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size
@ 2022-09-29 23:09 Michael Niedermayer
2022-09-29 23:09 ` [FFmpeg-devel] [PATCH 2/3] avcodec/speexdec: Check channels > 2 Michael Niedermayer
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Michael Niedermayer @ 2022-09-29 23:09 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Fixes: signed integer overflow: 119760682 - -2084600173 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6745781167587328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/vividas.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavformat/vividas.c b/libavformat/vividas.c
index e9954f73ed0..ed4e573df87 100644
--- a/libavformat/vividas.c
+++ b/libavformat/vividas.c
@@ -683,6 +683,7 @@ static int viv_read_packet(AVFormatContext *s,
if (viv->sb_entries[viv->current_sb_entry].flag == 0) {
uint64_t v_size = ffio_read_varlen(pb);
+ int last = 0, last_start;
if (!viv->num_audio)
return AVERROR_INVALIDDATA;
@@ -706,12 +707,18 @@ static int viv_read_packet(AVFormatContext *s,
if (i > 0 && start == 0)
break;
+ if (start < last)
+ return AVERROR_INVALIDDATA;
viv->n_audio_subpackets = i + 1;
+ last =
viv->audio_subpackets[i].start = start;
viv->audio_subpackets[i].pcm_bytes = pcm_bytes;
}
+ last_start =
viv->audio_subpackets[viv->n_audio_subpackets].start = (int)(off - avio_tell(pb));
+ if (last_start < last)
+ return AVERROR_INVALIDDATA;
viv->current_audio_subpacket = 0;
} else {
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 6+ messages in thread
* [FFmpeg-devel] [PATCH 2/3] avcodec/speexdec: Check channels > 2
2022-09-29 23:09 [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size Michael Niedermayer
@ 2022-09-29 23:09 ` Michael Niedermayer
2022-09-29 23:09 ` [FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check Michael Niedermayer
2022-10-04 21:43 ` [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size Michael Niedermayer
2 siblings, 0 replies; 6+ messages in thread
From: Michael Niedermayer @ 2022-09-29 23:09 UTC (permalink / raw)
To: FFmpeg development discussions and patches
More than 2 channels seems unsupported, the code seems to just output empty extra channels
Fixes: Timeout
Fixes: 51569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-5511509165342720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/speexdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c
index 9793d939fcb..08c7e77e7d5 100644
--- a/libavcodec/speexdec.c
+++ b/libavcodec/speexdec.c
@@ -1452,7 +1452,7 @@ static av_cold int speex_decode_init(AVCodecContext *avctx)
return AVERROR_INVALIDDATA;
s->nb_channels = avctx->ch_layout.nb_channels;
- if (s->nb_channels <= 0)
+ if (s->nb_channels <= 0 || s->nb_channels > 2)
return AVERROR_INVALIDDATA;
switch (s->rate) {
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 6+ messages in thread
* [FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check
2022-09-29 23:09 [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size Michael Niedermayer
2022-09-29 23:09 ` [FFmpeg-devel] [PATCH 2/3] avcodec/speexdec: Check channels > 2 Michael Niedermayer
@ 2022-09-29 23:09 ` Michael Niedermayer
2022-09-30 8:00 ` Paul B Mahol
2022-10-04 21:43 ` [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size Michael Niedermayer
2 siblings, 1 reply; 6+ messages in thread
From: Michael Niedermayer @ 2022-09-29 23:09 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Fixes: out of array access
Fixes: 51648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-4644322217164800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mlpdec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
index 635f92895c5..0b0eb759901 100644
--- a/libavcodec/mlpdec.c
+++ b/libavcodec/mlpdec.c
@@ -547,6 +547,9 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
return AVERROR_PATCHWELCOME;
}
+ if (max_channel + 1 > MAX_CHANNELS || max_channel + 1 < min_channel)
+ return AVERROR_INVALIDDATA;
+
s->min_channel = min_channel;
s->max_channel = max_channel;
s->coded_channels = ((1LL << (max_channel - min_channel + 1)) - 1) << min_channel;
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check
2022-09-29 23:09 ` [FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check Michael Niedermayer
@ 2022-09-30 8:00 ` Paul B Mahol
2022-09-30 17:28 ` Michael Niedermayer
0 siblings, 1 reply; 6+ messages in thread
From: Paul B Mahol @ 2022-09-30 8:00 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On 9/30/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> Fixes: out of array access
> Fixes:
> 51648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-4644322217164800
>
Make sure that this "fix"
does not break Mono.thd decoding.
The sample is on trac ticket.
Thanks.
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavcodec/mlpdec.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
> index 635f92895c5..0b0eb759901 100644
> --- a/libavcodec/mlpdec.c
> +++ b/libavcodec/mlpdec.c
> @@ -547,6 +547,9 @@ static int read_restart_header(MLPDecodeContext *m,
> GetBitContext *gbp,
> return AVERROR_PATCHWELCOME;
> }
>
> + if (max_channel + 1 > MAX_CHANNELS || max_channel + 1 < min_channel)
> + return AVERROR_INVALIDDATA;
> +
> s->min_channel = min_channel;
> s->max_channel = max_channel;
> s->coded_channels = ((1LL << (max_channel - min_channel + 1)) - 1)
> << min_channel;
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check
2022-09-30 8:00 ` Paul B Mahol
@ 2022-09-30 17:28 ` Michael Niedermayer
0 siblings, 0 replies; 6+ messages in thread
From: Michael Niedermayer @ 2022-09-30 17:28 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 784 bytes --]
On Fri, Sep 30, 2022 at 10:00:57AM +0200, Paul B Mahol wrote:
> On 9/30/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > Fixes: out of array access
> > Fixes:
> > 51648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-4644322217164800
> >
>
>
> Make sure that this "fix"
> does not break Mono.thd decoding.
> The sample is on trac ticket.
i have tested Mono.thd before posting the patch
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
Dictatorship: All citizens are under surveillance, all their steps and
actions recorded, for the politicians to enforce control.
Democracy: All politicians are under surveillance, all their steps and
actions recorded, for the citizens to enforce control.
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size
2022-09-29 23:09 [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size Michael Niedermayer
2022-09-29 23:09 ` [FFmpeg-devel] [PATCH 2/3] avcodec/speexdec: Check channels > 2 Michael Niedermayer
2022-09-29 23:09 ` [FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check Michael Niedermayer
@ 2022-10-04 21:43 ` Michael Niedermayer
2 siblings, 0 replies; 6+ messages in thread
From: Michael Niedermayer @ 2022-10-04 21:43 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 714 bytes --]
On Fri, Sep 30, 2022 at 01:09:25AM +0200, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 119760682 - -2084600173 cannot be represented in type 'int'
> Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6745781167587328
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavformat/vividas.c | 7 +++++++
> 1 file changed, 7 insertions(+)
will apply patchset
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
Republics decline into democracies and democracies degenerate into
despotisms. -- Aristotle
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-10-04 21:43 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-09-29 23:09 [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size Michael Niedermayer
2022-09-29 23:09 ` [FFmpeg-devel] [PATCH 2/3] avcodec/speexdec: Check channels > 2 Michael Niedermayer
2022-09-29 23:09 ` [FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check Michael Niedermayer
2022-09-30 8:00 ` Paul B Mahol
2022-09-30 17:28 ` Michael Niedermayer
2022-10-04 21:43 ` [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size Michael Niedermayer
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git