[FFmpeg-devel] [PATCH] libswresample: Prevent out of bounds.

[kobrineli <kobrineli@ispras.ru>]

From: Eli Kobrin <kobrineli@ispras.ru>

We've been fuzzing torchvision with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz)
and found out of bounds error in ffmpeg project at audioconvert.c:51.
To prevent error we need to insert corresponding check and fix checks
for in and out fmt in swr_init.

Signed-off-by: Eli Kobrin <kobrineli@ispras.ru>
---
 libswresample/audioconvert.c | 7 ++++++-
 libswresample/swresample.c   | 4 ++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/libswresample/audioconvert.c b/libswresample/audioconvert.c
index 1d75ba1495..701f4808a0 100644
--- a/libswresample/audioconvert.c
+++ b/libswresample/audioconvert.c
@@ -148,7 +148,12 @@ AudioConvert *swri_audio_convert_alloc(enum AVSampleFormat out_fmt,
                                        int flags)
 {
     AudioConvert *ctx;
-    conv_func_type *f = fmt_pair_to_conv_functions[av_get_packed_sample_fmt(out_fmt) + AV_SAMPLE_FMT_NB*av_get_packed_sample_fmt(in_fmt)];
+
+    size_t idx = av_get_packed_sample_fmt(out_fmt) + AV_SAMPLE_FMT_NB * av_get_packed_sample_fmt(in_fmt);
+    if (idx >= AV_SAMPLE_FMT_NB * AV_SAMPLE_FMT_NB)
+        return NULL;
+
+    conv_func_type *f = fmt_pair_to_conv_functions[idx];
 
     if (!f)
         return NULL;
diff --git a/libswresample/swresample.c b/libswresample/swresample.c
index 6dc329a9d0..b7cab36710 100644
--- a/libswresample/swresample.c
+++ b/libswresample/swresample.c
@@ -196,11 +196,11 @@ av_cold int swr_init(struct SwrContext *s){
 
     clear_context(s);
 
-    if(s-> in_sample_fmt >= AV_SAMPLE_FMT_NB){
+    if(s-> in_sample_fmt >= AV_SAMPLE_FMT_NB || s-> in_sample_fmt < 0){
         av_log(s, AV_LOG_ERROR, "Requested input sample format %d is invalid\n", s->in_sample_fmt);
         return AVERROR(EINVAL);
     }
-    if(s->out_sample_fmt >= AV_SAMPLE_FMT_NB){
+    if(s->out_sample_fmt >= AV_SAMPLE_FMT_NB || s->out_sample_fmt < 0){
         av_log(s, AV_LOG_ERROR, "Requested output sample format %d is invalid\n", s->out_sample_fmt);
         return AVERROR(EINVAL);
     }
-- 
2.25.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".