[FFmpeg-devel] [PATCH 1/3] avcodec/bonk: Use unsigned in predictor_init_state() to avoid undefined behavior

[FFmpeg-devel] [PATCH 1/3] avcodec/bonk: Use unsigned in predictor_init_state() to avoid undefined behavior

[Michael Niedermayer]

Fixes: signed integer overflow: -5010 * -717450 cannot be represented in type 'int'
Fixes: 53370/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-4945644204195840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/bonk.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c
index ebe8e46d70..df5a80b06e 100644
--- a/libavcodec/bonk.c
+++ b/libavcodec/bonk.c
@@ -277,10 +277,10 @@ static int predictor_calc_error(int *k, int *state, int order, int error)
     return x;
 }
 
-static void predictor_init_state(int *k, int *state, int order)
+static void predictor_init_state(int *k, unsigned *state, int order)
 {
     for (int i = order - 2; i >= 0; i--) {
-        int x = state[i];
+        unsigned x = state[i];
 
         for (int j = 0, p = i + 1; p < order; j++, p++) {
             int tmp = x + shift_down(k[j] * state[p], LATTICE_SHIFT);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/3] avcodec/apac: reset buffer on error

[Michael Niedermayer]

Fixes: repeatly parsing the same data after each 1 byte packet
Fixes: Timeout
Fixes: 51943/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APAC_fuzzer-5779018251370496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/apac.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/apac.c b/libavcodec/apac.c
index 6a1f61b842..e9f6a0dd88 100644
--- a/libavcodec/apac.c
+++ b/libavcodec/apac.c
@@ -191,6 +191,8 @@ static int apac_decode(AVCodecContext *avctx, AVFrame *frame,
             if (c->bit_length < 0 ||
                 c->bit_length > 17) {
                 c->bit_length = avctx->bits_per_coded_sample;
+                s->bitstream_index = 0;
+                s->bitstream_size  = 0;
                 return AVERROR_INVALIDDATA;
             }
 
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/3] avcodec/apac: reset buffer on error

[Paul B Mahol]

On 11/17/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> Fixes: repeatly parsing the same data after each 1 byte packet
> Fixes: Timeout
> Fixes:
> 51943/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APAC_fuzzer-5779018251370496
>

LGTM

> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/apac.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/libavcodec/apac.c b/libavcodec/apac.c
> index 6a1f61b842..e9f6a0dd88 100644
> --- a/libavcodec/apac.c
> +++ b/libavcodec/apac.c
> @@ -191,6 +191,8 @@ static int apac_decode(AVCodecContext *avctx, AVFrame
> *frame,
>              if (c->bit_length < 0 ||
>                  c->bit_length > 17) {
>                  c->bit_length = avctx->bits_per_coded_sample;
> +                s->bitstream_index = 0;
> +                s->bitstream_size  = 0;
>                  return AVERROR_INVALIDDATA;
>              }
>
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/3] avcodec/apac: reset buffer on error

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 555 bytes --]

On Thu, Nov 17, 2022 at 01:12:18AM +0100, Paul B Mahol wrote:
> On 11/17/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > Fixes: repeatly parsing the same data after each 1 byte packet
> > Fixes: Timeout
> > Fixes:
> > 51943/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APAC_fuzzer-5779018251370496
> >
> 
> LGTM

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I do not agree with what you have to say, but I'll defend to the death your
right to say it. -- Voltaire

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/3] avcodec/apac: use unsigned for sample residual

[Michael Niedermayer]

Fixes: signed integer overflow: -2146670226 + -2227242 cannot be represented in type 'int'
Fixes: 51943/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APAC_fuzzer-5779018251370496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/apac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/apac.c b/libavcodec/apac.c
index e9f6a0dd88..72ff41bdbb 100644
--- a/libavcodec/apac.c
+++ b/libavcodec/apac.c
@@ -204,7 +204,7 @@ static int apac_decode(AVCodecContext *avctx, AVFrame *frame,
 
             for (int i = 0; i < c->block_length; i++) {
                 int val = get_bits_long(gb, c->bit_length);
-                int delta = (val & 1) ? ~(val >> 1) : (val >> 1);
+                unsigned delta = (val & 1) ? ~(val >> 1) : (val >> 1);
                 int sample;
 
                 delta += c->last_delta;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/3] avcodec/bonk: Use unsigned in predictor_init_state() to avoid undefined behavior

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 880 bytes --]

On Thu, Nov 17, 2022 at 12:32:18AM +0100, Michael Niedermayer wrote:
> Fixes: signed integer overflow: -5010 * -717450 cannot be represented in type 'int'
> Fixes: 53370/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-4945644204195840
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/bonk.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

will apply remaining patches (1+3) of this patchset

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

When the tyrant has disposed of foreign enemies by conquest or treaty, and
there is nothing more to fear from them, then he is always stirring up
some war or other, in order that the people may require a leader. -- Plato

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".