From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 4F172464E0 for ; Mon, 19 Jun 2023 17:01:19 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 93C9268BF72; Mon, 19 Jun 2023 20:01:17 +0300 (EEST) Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [217.70.183.194]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 8344968A210 for ; Mon, 19 Jun 2023 20:01:10 +0300 (EEST) X-GND-Sasl: michael@niedermayer.cc Received: by mail.gandi.net (Postfix) with ESMTPSA id A7DC740006 for ; Mon, 19 Jun 2023 17:01:09 +0000 (UTC) Date: Mon, 19 Jun 2023 19:01:08 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20230619170108.GZ1391451@pb2> References: <20230618215021.3044-1-michael@niedermayer.cc> <20230618215021.3044-3-michael@niedermayer.cc> MIME-Version: 1.0 In-Reply-To: X-Spam-Flag: yes X-Spam-Level: *********** X-GND-Spam-Score: 165 X-GND-Status: SPAM Subject: Re: [FFmpeg-devel] [PATCH 3/6] avformat/jpegxl_anim_dec: add FF_JPEGXL_CONTAINER_SIGNATURE_LE X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============7395528459902638545==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============7395528459902638545== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="WFBruw+1XAMIZlde" Content-Disposition: inline --WFBruw+1XAMIZlde Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Jun 18, 2023 at 06:57:58PM -0400, Leo Izen wrote: > On 6/18/23 17:50, Michael Niedermayer wrote: > > Fixes: out of array read > > Fixes: 59828/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzz= er-5029813220671488 > >=20 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz= /tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer > > --- > > libavformat/jpegxl_anim_dec.c | 13 +++++++------ > > 1 file changed, 7 insertions(+), 6 deletions(-) > >=20 > > diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_de= c.c > > index c62b596f76..7e4d39385c 100644 > > --- a/libavformat/jpegxl_anim_dec.c > > +++ b/libavformat/jpegxl_anim_dec.c > > @@ -108,7 +108,7 @@ static int jpegxl_collect_codestream_header(const u= int8_t *input_buffer, int inp > > static int jpegxl_anim_probe(const AVProbeData *p) > > { > > - uint8_t buffer[4096]; > > + uint8_t buffer[4096 + AV_INPUT_BUFFER_PADDING_SIZE]; > > int copied; > > /* this is a raw codestream */ > > @@ -123,7 +123,7 @@ static int jpegxl_anim_probe(const AVProbeData *p) > > if (AV_RL64(p->buf) !=3D FF_JPEGXL_CONTAINER_SIGNATURE_LE) > > return 0; > > - if (jpegxl_collect_codestream_header(p->buf, p->buf_size, buffer, = sizeof(buffer), &copied) <=3D 0 || copied <=3D 0) > > + if (jpegxl_collect_codestream_header(p->buf, p->buf_size, buffer, = sizeof(buffer) - AV_INPUT_BUFFER_PADDING_SIZE, &copied) <=3D 0 || copied <= =3D 0) > > return 0; > > if (ff_jpegxl_verify_codestream_header(buffer, copied, 0) >=3D 1) > > @@ -138,7 +138,8 @@ static int jpegxl_anim_read_header(AVFormatContext = *s) > > AVIOContext *pb =3D s->pb; > > AVStream *st; > > int offset =3D 0; > > - uint8_t head[256]; > > + uint8_t head[256 + AV_INPUT_BUFFER_PADDING_SIZE]; > > + const int sizeofhead =3D sizeof(head) - AV_INPUT_BUFFER_PADDING_SI= ZE; > > int headsize =3D 0; > > int ctrl; > > AVRational tb; > > @@ -147,7 +148,7 @@ static int jpegxl_anim_read_header(AVFormatContext = *s) > > uint64_t sig16 =3D avio_rl16(pb); > > if (sig16 =3D=3D FF_JPEGXL_CODESTREAM_SIGNATURE_LE) { > > AV_WL16(head, sig16); > > - headsize =3D avio_read(s->pb, head + 2, sizeof(head) - 2); > > + headsize =3D avio_read(s->pb, head + 2, sizeofhead - 2); > > if (headsize < 0) > > return headsize; > > headsize +=3D 2; > > @@ -178,10 +179,10 @@ static int jpegxl_anim_read_header(AVFormatContex= t *s) > > if (av_buffer_realloc(&ctx->initial, ctx->initial->si= ze + read) < 0) > > return AVERROR(ENOMEM); > > } > > - jpegxl_collect_codestream_header(buf, read, head + headsiz= e, sizeof(head) - headsize, &copied); > > + jpegxl_collect_codestream_header(buf, read, head + headsiz= e, sizeofhead - headsize, &copied); > > memcpy(ctx->initial->data + (ctx->initial->size - read), = buf, read); > > headsize +=3D copied; > > - if (headsize >=3D sizeof(head) || read < sizeof(buf)) > > + if (headsize >=3D sizeofhead || read < sizeof(buf)) > > break; > > } > > } >=20 > What's with the commit message? Seems unrelated to the change. Must be some copy and paste mistake [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Republics decline into democracies and democracies degenerate into despotisms. -- Aristotle --WFBruw+1XAMIZlde Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZJCJzAAKCRBhHseHBAsP q/imAJsFn7ShwX6d4qXyOhylUjO7Txne5QCeN7uCIR4qLO7gTDMXAA4HgoVoPeM= =sCza -----END PGP SIGNATURE----- --WFBruw+1XAMIZlde-- --===============7395528459902638545== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============7395528459902638545==--