[FFmpeg-devel] [PATCH 1/2] avcodec/tiff: Avoid 0.0/0.0 in camera_xyz_coeff()

[FFmpeg-devel] [PATCH 1/2] avcodec/tiff: Avoid 0.0/0.0 in camera_xyz_coeff()

[Michael Niedermayer]

Fixes: division by zero
Fixes: 52230/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5922608915021824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/tiff.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 5b56892071..cde318d5e5 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1896,6 +1896,8 @@ static void camera_xyz_coeff(TiffContext *s,
     for (i = 0; i < 3; i++) {
         for (num = j = 0; j < 3; j++)
             num += cam2rgb[i][j];
+        if (!num)
+            num = 1;
         for (j = 0; j < 3; j++)
             cam2rgb[i][j] /= num;
         s->premultiply[i] = 1.f / num;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avcodec/h263dec: Avoid parsing extradata repeatedly

[Michael Niedermayer]

Fixes: Timeout
Fixes: 52329/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4716563886637056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/h263dec.c   | 3 ++-
 libavcodec/mpegvideo.h | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c
index 71b846ba74..4eab43d939 100644
--- a/libavcodec/h263dec.c
+++ b/libavcodec/h263dec.c
@@ -492,11 +492,12 @@ retry:
     } else if (CONFIG_MSMPEG4DEC && s->msmpeg4_version) {
         ret = ff_msmpeg4_decode_picture_header(s);
     } else if (CONFIG_MPEG4_DECODER && avctx->codec_id == AV_CODEC_ID_MPEG4) {
-        if (s->avctx->extradata_size && s->picture_number == 0) {
+        if (s->avctx->extradata_size && s->picture_number == 0 && !s->extradata_parsed) {
             GetBitContext gb;
 
             if (init_get_bits8(&gb, s->avctx->extradata, s->avctx->extradata_size) >= 0 )
                 ff_mpeg4_decode_picture_header(avctx->priv_data, &gb, 1, 0);
+            s->extradata_parsed = 1;
         }
         ret = ff_mpeg4_decode_picture_header(avctx->priv_data, &s->gb, 0, 0);
     } else if (CONFIG_H263I_DECODER && s->codec_id == AV_CODEC_ID_H263I) {
diff --git a/libavcodec/mpegvideo.h b/libavcodec/mpegvideo.h
index ccec0dd75f..6440b906b1 100644
--- a/libavcodec/mpegvideo.h
+++ b/libavcodec/mpegvideo.h
@@ -117,6 +117,7 @@ typedef struct MpegEncContext {
     int input_picture_number;  ///< used to set pic->display_picture_number, should not be used for/by anything else
     int coded_picture_number;  ///< used to set pic->coded_picture_number, should not be used for/by anything else
     int picture_number;       //FIXME remove, unclear definition
+    int extradata_parsed;
     int picture_in_gop_number; ///< 0-> first pic in gop, ...
     int mb_width, mb_height;   ///< number of MBs horizontally & vertically
     int mb_stride;             ///< mb_width+1 used for some arrays to allow simple addressing of left & top MBs without sig11
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/h263dec: Avoid parsing extradata repeatedly

[Anton Khirnov]

Quoting Michael Niedermayer (2022-11-18 00:14:18)
> Fixes: Timeout
> Fixes: 52329/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4716563886637056
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/h263dec.c   | 3 ++-
>  libavcodec/mpegvideo.h | 1 +
>  2 files changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c
> index 71b846ba74..4eab43d939 100644
> --- a/libavcodec/h263dec.c
> +++ b/libavcodec/h263dec.c
> @@ -492,11 +492,12 @@ retry:
>      } else if (CONFIG_MSMPEG4DEC && s->msmpeg4_version) {
>          ret = ff_msmpeg4_decode_picture_header(s);
>      } else if (CONFIG_MPEG4_DECODER && avctx->codec_id == AV_CODEC_ID_MPEG4) {
> -        if (s->avctx->extradata_size && s->picture_number == 0) {
> +        if (s->avctx->extradata_size && s->picture_number == 0 && !s->extradata_parsed) {

Wouldn't it make sense to get rid of the picture_number condition now?

-- 
Anton Khirnov
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/h263dec: Avoid parsing extradata repeatedly

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1573 bytes --]

On Mon, Nov 21, 2022 at 12:53:26PM +0100, Anton Khirnov wrote:
> Quoting Michael Niedermayer (2022-11-18 00:14:18)
> > Fixes: Timeout
> > Fixes: 52329/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4716563886637056
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/h263dec.c   | 3 ++-
> >  libavcodec/mpegvideo.h | 1 +
> >  2 files changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c
> > index 71b846ba74..4eab43d939 100644
> > --- a/libavcodec/h263dec.c
> > +++ b/libavcodec/h263dec.c
> > @@ -492,11 +492,12 @@ retry:
> >      } else if (CONFIG_MSMPEG4DEC && s->msmpeg4_version) {
> >          ret = ff_msmpeg4_decode_picture_header(s);
> >      } else if (CONFIG_MPEG4_DECODER && avctx->codec_id == AV_CODEC_ID_MPEG4) {
> > -        if (s->avctx->extradata_size && s->picture_number == 0) {
> > +        if (s->avctx->extradata_size && s->picture_number == 0 && !s->extradata_parsed) {
> 
> Wouldn't it make sense to get rid of the picture_number condition now?

I was thinking about droping it too. I dont know why i didnt, you are correct

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The real ebay dictionary, page 2
"100% positive feedback" - "All either got their money back or didnt complain"
"Best seller ever, very honest" - "Seller refunded buyer after failed scam"

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/h263dec: Avoid parsing extradata repeatedly

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1640 bytes --]

On Mon, Nov 21, 2022 at 07:53:53PM +0100, Michael Niedermayer wrote:
> On Mon, Nov 21, 2022 at 12:53:26PM +0100, Anton Khirnov wrote:
> > Quoting Michael Niedermayer (2022-11-18 00:14:18)
> > > Fixes: Timeout
> > > Fixes: 52329/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4716563886637056
> > > 
> > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > > ---
> > >  libavcodec/h263dec.c   | 3 ++-
> > >  libavcodec/mpegvideo.h | 1 +
> > >  2 files changed, 3 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c
> > > index 71b846ba74..4eab43d939 100644
> > > --- a/libavcodec/h263dec.c
> > > +++ b/libavcodec/h263dec.c
> > > @@ -492,11 +492,12 @@ retry:
> > >      } else if (CONFIG_MSMPEG4DEC && s->msmpeg4_version) {
> > >          ret = ff_msmpeg4_decode_picture_header(s);
> > >      } else if (CONFIG_MPEG4_DECODER && avctx->codec_id == AV_CODEC_ID_MPEG4) {
> > > -        if (s->avctx->extradata_size && s->picture_number == 0) {
> > > +        if (s->avctx->extradata_size && s->picture_number == 0 && !s->extradata_parsed) {
> > 
> > Wouldn't it make sense to get rid of the picture_number condition now?
> 
> I was thinking about droping it too. I dont know why i didnt, you are correct

will apply with the picture_number condition removed

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Opposition brings concord. Out of discord comes the fairest harmony.
-- Heraclitus

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/tiff: Avoid 0.0/0.0 in camera_xyz_coeff()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 631 bytes --]

On Fri, Nov 18, 2022 at 12:14:17AM +0100, Michael Niedermayer wrote:
> Fixes: division by zero
> Fixes: 52230/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5922608915021824
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/tiff.c | 2 ++
>  1 file changed, 2 insertions(+)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Republics decline into democracies and democracies degenerate into
despotisms. -- Aristotle

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".