* [FFmpeg-devel] [PATCH 2/3] avcodec/escape124: Fix some return codes
2023-03-05 23:36 [FFmpeg-devel] [PATCH 1/3] avcodec/escape124: fix signdness of end of input check Michael Niedermayer
@ 2023-03-05 23:36 ` Michael Niedermayer
2023-03-05 23:36 ` [FFmpeg-devel] [PATCH 3/3] avcodec/escape124: Simplify unpack_codebook() Michael Niedermayer
2023-03-12 19:31 ` [FFmpeg-devel] [PATCH 1/3] avcodec/escape124: fix signdness of end of input check Michael Niedermayer
2 siblings, 0 replies; 4+ messages in thread
From: Michael Niedermayer @ 2023-03-05 23:36 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/escape124.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/libavcodec/escape124.c b/libavcodec/escape124.c
index e9c6b2df1b..064a4e6bf5 100644
--- a/libavcodec/escape124.c
+++ b/libavcodec/escape124.c
@@ -89,11 +89,6 @@ static CodeBook unpack_codebook(GetBitContext* gb, unsigned depth,
unsigned i, j;
CodeBook cb = { 0 };
- if (size >= INT_MAX / 34 || get_bits_left(gb) < (int)size * 34)
- return cb;
-
- if (size >= INT_MAX / sizeof(MacroBlock))
- return cb;
cb.blocks = av_malloc(size ? size * sizeof(MacroBlock) : 1);
if (!cb.blocks)
return cb;
@@ -225,7 +220,7 @@ static int escape124_decode_frame(AVCodecContext *avctx, AVFrame *frame,
// represent a lower bound of the space needed for skipped superblocks. Non
// skipped SBs need more space.
if (get_bits_left(&gb) < 64 + s->num_superblocks * 23LL / 4320)
- return -1;
+ return AVERROR_INVALIDDATA;
frame_flags = get_bits_long(&gb, 32);
frame_size = get_bits_long(&gb, 32);
@@ -276,9 +271,14 @@ static int escape124_decode_frame(AVCodecContext *avctx, AVFrame *frame,
}
av_freep(&s->codebooks[i].blocks);
+ if (cb_size >= INT_MAX / 34 || get_bits_left(&gb) < (int)cb_size * 34)
+ return AVERROR_INVALIDDATA;
+
+ if (cb_size >= INT_MAX / sizeof(MacroBlock))
+ return AVERROR_INVALIDDATA;
s->codebooks[i] = unpack_codebook(&gb, cb_depth, cb_size);
if (!s->codebooks[i].blocks)
- return -1;
+ return AVERROR(ENOMEM);
}
}
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread* [FFmpeg-devel] [PATCH 3/3] avcodec/escape124: Simplify unpack_codebook()
2023-03-05 23:36 [FFmpeg-devel] [PATCH 1/3] avcodec/escape124: fix signdness of end of input check Michael Niedermayer
2023-03-05 23:36 ` [FFmpeg-devel] [PATCH 2/3] avcodec/escape124: Fix some return codes Michael Niedermayer
@ 2023-03-05 23:36 ` Michael Niedermayer
2023-03-12 19:31 ` [FFmpeg-devel] [PATCH 1/3] avcodec/escape124: fix signdness of end of input check Michael Niedermayer
2 siblings, 0 replies; 4+ messages in thread
From: Michael Niedermayer @ 2023-03-05 23:36 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/escape124.c | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/libavcodec/escape124.c b/libavcodec/escape124.c
index 064a4e6bf5..e8a8395f4b 100644
--- a/libavcodec/escape124.c
+++ b/libavcodec/escape124.c
@@ -97,15 +97,12 @@ static CodeBook unpack_codebook(GetBitContext* gb, unsigned depth,
cb.size = size;
for (i = 0; i < size; i++) {
unsigned mask_bits = get_bits(gb, 4);
- unsigned color0 = get_bits(gb, 15);
- unsigned color1 = get_bits(gb, 15);
-
- for (j = 0; j < 4; j++) {
- if (mask_bits & (1 << j))
- cb.blocks[i].pixels[j] = color1;
- else
- cb.blocks[i].pixels[j] = color0;
- }
+ unsigned color[2];
+ color[0] = get_bits(gb, 15);
+ color[1] = get_bits(gb, 15);
+
+ for (j = 0; j < 4; j++)
+ cb.blocks[i].pixels[j] = color[(mask_bits>>j) & 1];
}
return cb;
}
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [FFmpeg-devel] [PATCH 1/3] avcodec/escape124: fix signdness of end of input check
2023-03-05 23:36 [FFmpeg-devel] [PATCH 1/3] avcodec/escape124: fix signdness of end of input check Michael Niedermayer
2023-03-05 23:36 ` [FFmpeg-devel] [PATCH 2/3] avcodec/escape124: Fix some return codes Michael Niedermayer
2023-03-05 23:36 ` [FFmpeg-devel] [PATCH 3/3] avcodec/escape124: Simplify unpack_codebook() Michael Niedermayer
@ 2023-03-12 19:31 ` Michael Niedermayer
2 siblings, 0 replies; 4+ messages in thread
From: Michael Niedermayer @ 2023-03-12 19:31 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 626 bytes --]
On Mon, Mar 06, 2023 at 12:36:52AM +0100, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 56561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5560363635834880
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavcodec/escape124.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
will apply patchset
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
What does censorship reveal? It reveals fear. -- Julian Assange
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread