[FFmpeg-devel] [PATCH 1/2] avcodec/utils: use 32pixel alignment for bink

[FFmpeg-devel] [PATCH 1/2] avcodec/utils: use 32pixel alignment for bink

[Michael Niedermayer]

bink supports 16x16 blocks in chroma planes thus we need to allocate enough.
Fixes: out of array access
Fixes: 55026/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6013915371012096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/utils.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index 2b63a498b9..87634e3711 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -243,6 +243,8 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
     case AV_PIX_FMT_GBRAP16BE:
         w_align = 16; //FIXME assume 16 pixel per macroblock
         h_align = 16 * 2; // interlaced needs 2 macroblocks height
+        if (s->codec_id == AV_CODEC_ID_BINKVIDEO)
+            w_align = 16*2;
         break;
     case AV_PIX_FMT_YUV411P:
     case AV_PIX_FMT_YUVJ411P:
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avutil/tx_priv: Use unsigned in BF() to avoid signed overflows

[Michael Niedermayer]

Fixes: signed integer overflow: 100183269 - -2132769113 cannot be represented in type 'int'
Fixes: 55063/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5039294027005952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavutil/tx_priv.h | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/libavutil/tx_priv.h b/libavutil/tx_priv.h
index 72f336eea7..d5ff8e1421 100644
--- a/libavutil/tx_priv.h
+++ b/libavutil/tx_priv.h
@@ -102,6 +102,12 @@ typedef void TXComplex;
 
 #define FOLD(a, b) ((a) + (b))
 
+#define BF(x, y, a, b)  \
+    do {                \
+        x = (a) - (b);  \
+        y = (a) + (b);  \
+    } while (0)
+
 #elif defined(TX_INT32)
 
 /* Properly rounds the result */
@@ -132,14 +138,14 @@ typedef void TXComplex;
 
 #define FOLD(x, y) ((int32_t)((x) + (unsigned)(y) + 32) >> 6)
 
-#endif /* TX_INT32 */
-
 #define BF(x, y, a, b)  \
     do {                \
-        x = (a) - (b);  \
-        y = (a) + (b);  \
+        x = (a) - (unsigned)(b);  \
+        y = (a) + (unsigned)(b);  \
     } while (0)
 
+#endif /* TX_INT32 */
+
 #define CMUL3(c, a, b) CMUL((c).re, (c).im, (a).re, (a).im, (b).re, (b).im)
 
 /* Codelet flags, used to pick codelets. Must be a superset of enum AVTXFlags,
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/utils: use 32pixel alignment for bink

[Peter Ross]

[-- Attachment #1.1: Type: text/plain, Size: 1196 bytes --]

On Sun, Jan 22, 2023 at 01:02:21AM +0100, Michael Niedermayer wrote:
> bink supports 16x16 blocks in chroma planes thus we need to allocate enough.
> Fixes: out of array access
> Fixes: 55026/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6013915371012096
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/utils.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> index 2b63a498b9..87634e3711 100644
> --- a/libavcodec/utils.c
> +++ b/libavcodec/utils.c
> @@ -243,6 +243,8 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
>      case AV_PIX_FMT_GBRAP16BE:
>          w_align = 16; //FIXME assume 16 pixel per macroblock
>          h_align = 16 * 2; // interlaced needs 2 macroblocks height
> +        if (s->codec_id == AV_CODEC_ID_BINKVIDEO)
> +            w_align = 16*2;
>          break;
>      case AV_PIX_FMT_YUV411P:
>      case AV_PIX_FMT_YUVJ411P:

please apply.

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/utils: use 32pixel alignment for bink

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1590 bytes --]

On Fri, Jan 27, 2023 at 10:59:38AM +1100, Peter Ross wrote:
> On Sun, Jan 22, 2023 at 01:02:21AM +0100, Michael Niedermayer wrote:
> > bink supports 16x16 blocks in chroma planes thus we need to allocate enough.
> > Fixes: out of array access
> > Fixes: 55026/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6013915371012096
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/utils.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> > index 2b63a498b9..87634e3711 100644
> > --- a/libavcodec/utils.c
> > +++ b/libavcodec/utils.c
> > @@ -243,6 +243,8 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
> >      case AV_PIX_FMT_GBRAP16BE:
> >          w_align = 16; //FIXME assume 16 pixel per macroblock
> >          h_align = 16 * 2; // interlaced needs 2 macroblocks height
> > +        if (s->codec_id == AV_CODEC_ID_BINKVIDEO)
> > +            w_align = 16*2;
> >          break;
> >      case AV_PIX_FMT_YUV411P:
> >      case AV_PIX_FMT_YUVJ411P:
> 
> please apply.

will apply

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Frequently ignored answer#1 FFmpeg bugs should be sent to our bugtracker. User
questions about the command line tools should be sent to the ffmpeg-user ML.
And questions about how to use libav* should be sent to the libav-user ML.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avutil/tx_priv: Use unsigned in BF() to avoid signed overflows

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 693 bytes --]

On Sun, Jan 22, 2023 at 01:02:22AM +0100, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 100183269 - -2132769113 cannot be represented in type 'int'
> Fixes: 55063/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5039294027005952
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavutil/tx_priv.h | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

You can kill me, but you cannot change the truth.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".