[FFmpeg-devel] [PATCH 1/2] avcodec/hdrdec: Check for end of input in decompress()

[FFmpeg-devel] [PATCH 1/2] avcodec/hdrdec: Check for end of input in decompress()

[Michael Niedermayer]

Fixes: Timeout
Fixes: 54386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5053598268784640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/hdrdec.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c
index 21d3e7f693..998227744b 100644
--- a/libavcodec/hdrdec.c
+++ b/libavcodec/hdrdec.c
@@ -58,6 +58,8 @@ static int decompress(uint8_t *scanline, int w, GetByteContext *gb, const uint8_
     int rshift = 0;
 
     while (w > 0) {
+        if (bytestream2_get_bytes_left(gb) < 4)
+            return AVERROR_INVALIDDATA;
         scanline[0] = bytestream2_get_byte(gb);
         scanline[1] = bytestream2_get_byte(gb);
         scanline[2] = bytestream2_get_byte(gb);
@@ -143,13 +145,17 @@ static int hdr_decode_frame(AVCodecContext *avctx, AVFrame *p,
         int i;
 
         if (width < MINELEN || width > MAXELEN) {
-            decompress(scanline, width, &gb, scanline);
+            ret = decompress(scanline, width, &gb, scanline);
+            if (ret < 0)
+                return ret;
             goto convert;
         }
 
         i = bytestream2_peek_byte(&gb);
         if (i != 2) {
-            decompress(scanline, width, &gb, scanline);
+            ret = decompress(scanline, width, &gb, scanline);
+            if (ret < 0)
+                return ret;
             goto convert;
         }
         bytestream2_skip(&gb, 1);
@@ -161,7 +167,9 @@ static int hdr_decode_frame(AVCodecContext *avctx, AVFrame *p,
         if (scanline[1] != 2 || scanline[2] & 128) {
             scanline[0] = 2;
             scanline[3] = i;
-            decompress(scanline + 4, width - 1, &gb, scanline);
+            ret = decompress(scanline + 4, width - 1, &gb, scanline);
+            if (ret < 0)
+                return ret;
             goto convert;
         }
 
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avformat/mxfdec: Use 64bit in remainder

[Michael Niedermayer]

Fixes: signed integer overflow: 48000 * 223587 cannot be represented in type 'int'
Fixes: 54513/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5817594836025344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mxfdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index e6118e141d..6150c131ec 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -3857,8 +3857,8 @@ static int64_t mxf_compute_sample_count(MXFContext *mxf, AVStream *st,
     if ((sample_rate.num / sample_rate.den) == 48000) {
         return av_rescale_q(edit_unit, sample_rate, track->edit_rate);
     } else {
-        int remainder = (sample_rate.num * time_base.num) %
-                        (time_base.den * sample_rate.den);
+        int64_t remainder = (sample_rate.num * (int64_t)time_base.num) %
+                        (time_base.den * (int64_t)sample_rate.den);
         if (remainder)
             av_log(mxf->fc, AV_LOG_WARNING,
                    "seeking detected on stream #%d with time base (%d/%d) and "
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avformat/mxfdec: Use 64bit in remainder

[Tomas Härdin]

sön 2022-12-25 klockan 23:03 +0100 skrev Michael Niedermayer:
> Fixes: signed integer overflow: 48000 * 223587 cannot be represented
> in type 'int'
> Fixes: 54513/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-
> 5817594836025344
> 
> Found-by: continuous fuzzing process 
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/mxfdec.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> index e6118e141d..6150c131ec 100644
> --- a/libavformat/mxfdec.c
> +++ b/libavformat/mxfdec.c
> @@ -3857,8 +3857,8 @@ static int64_t
> mxf_compute_sample_count(MXFContext *mxf, AVStream *st,
>      if ((sample_rate.num / sample_rate.den) == 48000) {
>          return av_rescale_q(edit_unit, sample_rate, track-
> >edit_rate);
>      } else {
> -        int remainder = (sample_rate.num * time_base.num) %
> -                        (time_base.den * sample_rate.den);
> +        int64_t remainder = (sample_rate.num *
> (int64_t)time_base.num) %
> +                        (time_base.den * (int64_t)sample_rate.den);
>          if (remainder)

Looks OK. Could use uint64_t also I think

/Tomas

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/hdrdec: Check for end of input in decompress()

[Paul B Mahol]

On 12/25/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> Fixes: Timeout
> Fixes:
> 54386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5053598268784640
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/hdrdec.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c
> index 21d3e7f693..998227744b 100644
> --- a/libavcodec/hdrdec.c
> +++ b/libavcodec/hdrdec.c
> @@ -58,6 +58,8 @@ static int decompress(uint8_t *scanline, int w,
> GetByteContext *gb, const uint8_
>      int rshift = 0;
>
>      while (w > 0) {
> +        if (bytestream2_get_bytes_left(gb) < 4)
> +            return AVERROR_INVALIDDATA;
>          scanline[0] = bytestream2_get_byte(gb);
>          scanline[1] = bytestream2_get_byte(gb);
>          scanline[2] = bytestream2_get_byte(gb);
> @@ -143,13 +145,17 @@ static int hdr_decode_frame(AVCodecContext *avctx,
> AVFrame *p,
>          int i;
>
>          if (width < MINELEN || width > MAXELEN) {
> -            decompress(scanline, width, &gb, scanline);
> +            ret = decompress(scanline, width, &gb, scanline);
> +            if (ret < 0)
> +                return ret;
>              goto convert;
>          }
>
>          i = bytestream2_peek_byte(&gb);
>          if (i != 2) {
> -            decompress(scanline, width, &gb, scanline);
> +            ret = decompress(scanline, width, &gb, scanline);
> +            if (ret < 0)
> +                return ret;
>              goto convert;
>          }
>          bytestream2_skip(&gb, 1);
> @@ -161,7 +167,9 @@ static int hdr_decode_frame(AVCodecContext *avctx,
> AVFrame *p,
>          if (scanline[1] != 2 || scanline[2] & 128) {
>              scanline[0] = 2;
>              scanline[3] = i;
> -            decompress(scanline + 4, width - 1, &gb, scanline);
> +            ret = decompress(scanline + 4, width - 1, &gb, scanline);
> +            if (ret < 0)
> +                return ret;
>              goto convert;
>          }
>
> --
> 2.17.1
>

LGTM

> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avformat/mxfdec: Use 64bit in remainder

[James Almer]

On 12/25/2022 7:03 PM, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 48000 * 223587 cannot be represented in type 'int'
> Fixes: 54513/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5817594836025344
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavformat/mxfdec.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> index e6118e141d..6150c131ec 100644
> --- a/libavformat/mxfdec.c
> +++ b/libavformat/mxfdec.c
> @@ -3857,8 +3857,8 @@ static int64_t mxf_compute_sample_count(MXFContext *mxf, AVStream *st,
>       if ((sample_rate.num / sample_rate.den) == 48000) {
>           return av_rescale_q(edit_unit, sample_rate, track->edit_rate);
>       } else {
> -        int remainder = (sample_rate.num * time_base.num) %
> -                        (time_base.den * sample_rate.den);
> +        int64_t remainder = (sample_rate.num * (int64_t)time_base.num) %
> +                        (time_base.den * (int64_t)sample_rate.den);

Don't undo the vertical alignment, please.

>           if (remainder)
>               av_log(mxf->fc, AV_LOG_WARNING,
>                      "seeking detected on stream #%d with time base (%d/%d) and "
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avformat/mxfdec: Use 64bit in remainder

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1610 bytes --]

On Mon, Dec 26, 2022 at 11:11:46AM -0300, James Almer wrote:
> On 12/25/2022 7:03 PM, Michael Niedermayer wrote:
> > Fixes: signed integer overflow: 48000 * 223587 cannot be represented in type 'int'
> > Fixes: 54513/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5817594836025344
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >   libavformat/mxfdec.c | 4 ++--
> >   1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> > index e6118e141d..6150c131ec 100644
> > --- a/libavformat/mxfdec.c
> > +++ b/libavformat/mxfdec.c
> > @@ -3857,8 +3857,8 @@ static int64_t mxf_compute_sample_count(MXFContext *mxf, AVStream *st,
> >       if ((sample_rate.num / sample_rate.den) == 48000) {
> >           return av_rescale_q(edit_unit, sample_rate, track->edit_rate);
> >       } else {
> > -        int remainder = (sample_rate.num * time_base.num) %
> > -                        (time_base.den * sample_rate.den);
> > +        int64_t remainder = (sample_rate.num * (int64_t)time_base.num) %
> > +                        (time_base.den * (int64_t)sample_rate.den);
> 
> Don't undo the vertical alignment, please.

Will apply it with maximal vertical alignment

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I have never wished to cater to the crowd; for what I know they do not
approve, and what they approve I do not know. -- Epicurus

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avformat/mxfdec: Use 64bit in remainder

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1657 bytes --]

On Mon, Dec 26, 2022 at 11:36:28AM +0100, Tomas Härdin wrote:
> sön 2022-12-25 klockan 23:03 +0100 skrev Michael Niedermayer:
> > Fixes: signed integer overflow: 48000 * 223587 cannot be represented
> > in type 'int'
> > Fixes: 54513/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-
> > 5817594836025344
> > 
> > Found-by: continuous fuzzing process 
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/mxfdec.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> > index e6118e141d..6150c131ec 100644
> > --- a/libavformat/mxfdec.c
> > +++ b/libavformat/mxfdec.c
> > @@ -3857,8 +3857,8 @@ static int64_t
> > mxf_compute_sample_count(MXFContext *mxf, AVStream *st,
> >      if ((sample_rate.num / sample_rate.den) == 48000) {
> >          return av_rescale_q(edit_unit, sample_rate, track-
> > >edit_rate);
> >      } else {
> > -        int remainder = (sample_rate.num * time_base.num) %
> > -                        (time_base.den * sample_rate.den);
> > +        int64_t remainder = (sample_rate.num *
> > (int64_t)time_base.num) %
> > +                        (time_base.den * (int64_t)sample_rate.den);
> >          if (remainder)
> 
> Looks OK. Could use uint64_t also I think

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Dictatorship naturally arises out of democracy, and the most aggravated
form of tyranny and slavery out of the most extreme liberty. -- Plato

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/hdrdec: Check for end of input in decompress()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 2676 bytes --]

On Mon, Dec 26, 2022 at 03:08:38PM +0100, Paul B Mahol wrote:
> On 12/25/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > Fixes: Timeout
> > Fixes:
> > 54386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5053598268784640
> >
> > Found-by: continuous fuzzing process
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/hdrdec.c | 14 +++++++++++---
> >  1 file changed, 11 insertions(+), 3 deletions(-)
> >
> > diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c
> > index 21d3e7f693..998227744b 100644
> > --- a/libavcodec/hdrdec.c
> > +++ b/libavcodec/hdrdec.c
> > @@ -58,6 +58,8 @@ static int decompress(uint8_t *scanline, int w,
> > GetByteContext *gb, const uint8_
> >      int rshift = 0;
> >
> >      while (w > 0) {
> > +        if (bytestream2_get_bytes_left(gb) < 4)
> > +            return AVERROR_INVALIDDATA;
> >          scanline[0] = bytestream2_get_byte(gb);
> >          scanline[1] = bytestream2_get_byte(gb);
> >          scanline[2] = bytestream2_get_byte(gb);
> > @@ -143,13 +145,17 @@ static int hdr_decode_frame(AVCodecContext *avctx,
> > AVFrame *p,
> >          int i;
> >
> >          if (width < MINELEN || width > MAXELEN) {
> > -            decompress(scanline, width, &gb, scanline);
> > +            ret = decompress(scanline, width, &gb, scanline);
> > +            if (ret < 0)
> > +                return ret;
> >              goto convert;
> >          }
> >
> >          i = bytestream2_peek_byte(&gb);
> >          if (i != 2) {
> > -            decompress(scanline, width, &gb, scanline);
> > +            ret = decompress(scanline, width, &gb, scanline);
> > +            if (ret < 0)
> > +                return ret;
> >              goto convert;
> >          }
> >          bytestream2_skip(&gb, 1);
> > @@ -161,7 +167,9 @@ static int hdr_decode_frame(AVCodecContext *avctx,
> > AVFrame *p,
> >          if (scanline[1] != 2 || scanline[2] & 128) {
> >              scanline[0] = 2;
> >              scanline[3] = i;
> > -            decompress(scanline + 4, width - 1, &gb, scanline);
> > +            ret = decompress(scanline + 4, width - 1, &gb, scanline);
> > +            if (ret < 0)
> > +                return ret;
> >              goto convert;
> >          }
> >
> > --
> > 2.17.1
> >
> 
> LGTM

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Good people do not need laws to tell them to act responsibly, while bad
people will find a way around the laws. -- Plato

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".