From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <ffmpeg-devel-bounces@ffmpeg.org>
Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100])
by master.gitmailbox.com (Postfix) with ESMTP id 9661140C8E
for <ffmpegdev@gitmailbox.com>; Sun, 6 Nov 2022 12:30:45 +0000 (UTC)
Received: from [127.0.1.1] (localhost [127.0.0.1])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 7C1FD680BE5;
Sun, 6 Nov 2022 14:30:44 +0200 (EET)
Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net
[217.70.183.194])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id F0CF968B04D
for <ffmpeg-devel@ffmpeg.org>; Sun, 6 Nov 2022 14:30:37 +0200 (EET)
Received: (Authenticated sender: michael@niedermayer.cc)
by mail.gandi.net (Postfix) with ESMTPSA id 1FB2540003
for <ffmpeg-devel@ffmpeg.org>; Sun, 6 Nov 2022 12:30:36 +0000 (UTC)
Date: Sun, 6 Nov 2022 13:30:36 +0100
From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Message-ID: <20221106123036.GV1814017@pb2>
References: <20221105201629.1980-1-michael@niedermayer.cc>
<20221105201629.1980-4-michael@niedermayer.cc>
<CAPYw7P4Kt4iMDTWQDfwhHH_wPOzSBSe0Rie7JO3Hr-vYBH-PAg@mail.gmail.com>
MIME-Version: 1.0
In-Reply-To: <CAPYw7P4Kt4iMDTWQDfwhHH_wPOzSBSe0Rie7JO3Hr-vYBH-PAg@mail.gmail.com>
Subject: Re: [FFmpeg-devel] [PATCH 4/4] avcodec/bonk: Check for undefined
overflow in predictor_calc_error()
X-BeenThere: ffmpeg-devel@ffmpeg.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org>
List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe>
List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel>
List-Post: <mailto:ffmpeg-devel@ffmpeg.org>
List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help>
List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe>
Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Content-Type: multipart/mixed; boundary="===============7129451383053388781=="
Errors-To: ffmpeg-devel-bounces@ffmpeg.org
Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org>
Archived-At: <https://master.gitmailbox.com/ffmpegdev/20221106123036.GV1814017@pb2/>
List-Archive: <https://master.gitmailbox.com/ffmpegdev/>
List-Post: <mailto:ffmpegdev@gitmailbox.com>
--===============7129451383053388781==
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature"; boundary="CJCg3p2l15m1juT/"
Content-Disposition: inline
--CJCg3p2l15m1juT/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Sun, Nov 06, 2022 at 09:50:47AM +0100, Paul B Mahol wrote:
> On 11/5/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > Fixes: signed integer overflow: 22 * -2107998208 cannot be represented =
in
> > type 'int'
> > Fixes:
> > 51363/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-566=
0734784143360
> >
> > Found-by: continuous fuzzing process
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavcodec/bonk.c | 11 +++++++++--
> > 1 file changed, 9 insertions(+), 2 deletions(-)
> >
> > diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c
> > index 1695229dbd..40963aa7c6 100644
> > --- a/libavcodec/bonk.c
> > +++ b/libavcodec/bonk.c
> > @@ -278,10 +278,13 @@ static int predictor_calc_error(int *k, int *stat=
e,
> > int order, int error)
> > *state_ptr =3D &(state[order-2]);
> >
> > for (i =3D order-2; i >=3D 0; i--, k_ptr--, state_ptr--) {
> > - int k_value =3D *k_ptr, state_value =3D *state_ptr;
> > + int64_t k_value =3D *k_ptr, state_value =3D *state_ptr;
> >
> > x -=3D shift_down(k_value * state_value, LATTICE_SHIFT);
> > - state_ptr[1] =3D state_value + shift_down(k_value * x,
> > LATTICE_SHIFT);
> > + k_value *=3D x;
> > + if ((int32_t)k_value !=3D k_value)
> > + return AVERROR_INVALIDDATA;
> > + state_ptr[1] =3D state_value + shift_down(k_value, LATTICE_SHI=
FT);
> > }
> >
> > // don't drift too far, to avoid overflows
> > @@ -366,6 +369,8 @@ static int bonk_decode(AVCodecContext *avctx, AVFra=
me
> > *frame,
> > int64_t t64;
> > for (int j =3D 0; j < s->down_sampling - 1; j++) {
> > sample[0] =3D predictor_calc_error(s->k, state, s->n_t=
aps,
> > 0);
> > + if (sample[0] =3D=3D AVERROR_INVALIDDATA)
> > + return sample[0];
> > sample++;
> > }
> >
> > @@ -374,6 +379,8 @@ static int bonk_decode(AVCodecContext *avctx, AVFra=
me
> > *frame,
> > return AVERROR_INVALIDDATA;
> >
> > sample[0] =3D predictor_calc_error(s->k, state, s->n_taps,=
t64);
> > + if (sample[0] =3D=3D AVERROR_INVALIDDATA)
> > + return sample[0];
> > sample++;
> > }
> >
> > --
> > 2.17.1
> >
>=20
>=20
> NAK,
>=20
> slowing things down by using int64_t
ill post some other solution, it seems slower indeed, i was hoping
gcc would produce smarter code
thx
[...]
--=20
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
Elect your leaders based on what they did after the last election, not
based on what they say before an election.
--CJCg3p2l15m1juT/
Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCY2eo7AAKCRBhHseHBAsP
qwijAJ92yzvtcCg7cndav9YvyEZ2Oyr97wCfe20AywFwk/rT/tbgdnmjkHcIdQ4=
=Faus
-----END PGP SIGNATURE-----
--CJCg3p2l15m1juT/--
--===============7129451383053388781==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
--===============7129451383053388781==--