[FFmpeg-devel] [PATCH] avcodec/bonk: check level value to not reach invalid values

[FFmpeg-devel] [PATCH] avcodec/bonk: check level value to not reach invalid values

[Paul B Mahol]

[-- Attachment #1: Type: text/plain, Size: 16 bytes --]

Patch attached.

[-- Attachment #2: 0001-avcodec-bonk-check-level-value-to-not-reach-invalid-.patch --]
[-- Type: text/x-patch, Size: 1726 bytes --]

From 1b9204a39ea111f4fa34fe9cb4254dea2f20923d Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Tue, 22 Nov 2022 11:27:39 +0100
Subject: [PATCH] avcodec/bonk: check level value to not reach invalid values

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/bonk.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c
index 2b2e202428..4793bf2561 100644
--- a/libavcodec/bonk.c
+++ b/libavcodec/bonk.c
@@ -217,6 +217,9 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
             level += 1 << low_bits;
         }
 
+        if (level > 1 << 15)
+            return AVERROR_INVALIDDATA;
+
         if (x >= max_x)
             return AVERROR_INVALIDDATA;
 
@@ -330,7 +333,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
 
     skip_bits(gb, s->skip);
     if ((ret = intlist_read(s, s->k, s->n_taps, 0)) < 0)
-        return ret;
+        goto fail;
 
     for (int i = 0; i < s->n_taps; i++)
         s->k[i] *= s->quant[i];
@@ -345,7 +348,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
 
         predictor_init_state(s->k, state, s->n_taps);
         if ((ret = intlist_read(s, s->input_samples, samples_per_packet, 1)) < 0)
-            return ret;
+            goto fail;
 
         for (int i = 0; i < samples_per_packet; i++) {
             for (int j = 0; j < s->down_sampling - 1; j++) {
@@ -390,6 +393,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
     n = get_bits_count(gb) / 8;
 
     if (n > buf_size) {
+fail:
         s->bitstream_size = 0;
         s->bitstream_index = 0;
         return AVERROR_INVALIDDATA;
-- 
2.37.2


[-- Attachment #3: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avcodec/bonk: check level value to not reach invalid values

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 2010 bytes --]

On Tue, Nov 22, 2022 at 11:26:48AM +0100, Paul B Mahol wrote:
> Patch attached.

>  bonk.c |    8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 84abac919e9c120e48bb1a3f84be0697f620b66a  0001-avcodec-bonk-check-level-value-to-not-reach-invalid-.patch
> From 1b9204a39ea111f4fa34fe9cb4254dea2f20923d Mon Sep 17 00:00:00 2001
> From: Paul B Mahol <onemda@gmail.com>
> Date: Tue, 22 Nov 2022 11:27:39 +0100
> Subject: [PATCH] avcodec/bonk: check level value to not reach invalid values
> 
> Signed-off-by: Paul B Mahol <onemda@gmail.com>
> ---
>  libavcodec/bonk.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
[...]

> @@ -330,7 +333,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
>  
>      skip_bits(gb, s->skip);
>      if ((ret = intlist_read(s, s->k, s->n_taps, 0)) < 0)
> -        return ret;
> +        goto fail;
>  
>      for (int i = 0; i < s->n_taps; i++)
>          s->k[i] *= s->quant[i];
> @@ -345,7 +348,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
>  
>          predictor_init_state(s->k, state, s->n_taps);
>          if ((ret = intlist_read(s, s->input_samples, samples_per_packet, 1)) < 0)
> -            return ret;
> +            goto fail;
>  
>          for (int i = 0; i < samples_per_packet; i++) {
>              for (int j = 0; j < s->down_sampling - 1; j++) {
> @@ -390,6 +393,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
>      n = get_bits_count(gb) / 8;
>  
>      if (n > buf_size) {
> +fail:
>          s->bitstream_size = 0;
>          s->bitstream_index = 0;
>          return AVERROR_INVALIDDATA;
> -- 

LGTM

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

When the tyrant has disposed of foreign enemies by conquest or treaty, and
there is nothing more to fear from them, then he is always stirring up
some war or other, in order that the people may require a leader. -- Plato

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".