* [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac()
@ 2023-07-23 18:02 Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[] Michael Niedermayer
` (4 more replies)
0 siblings, 5 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:02 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Fixes: Timeout
Fixes: 59952/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-6718213736759296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/vmixdec.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/vmixdec.c b/libavcodec/vmixdec.c
index b77c90929a..4cc5963e25 100644
--- a/libavcodec/vmixdec.c
+++ b/libavcodec/vmixdec.c
@@ -115,6 +115,8 @@ static int decode_dcac(AVCodecContext *avctx,
if (dc_run > 0) {
dc_run--;
} else {
+ if (get_bits_left(dc_gb) < 1)
+ return AVERROR_INVALIDDATA;
dc_v = get_se_golomb_vmix(dc_gb);
dc += (unsigned)dc_v;
if (!dc_v)
@@ -127,6 +129,8 @@ static int decode_dcac(AVCodecContext *avctx,
continue;
}
+ if (get_bits_left(ac_gb) < 1)
+ return AVERROR_INVALIDDATA;
ac_v = get_se_golomb_vmix(ac_gb);
i = scan[n];
block[i] = ((unsigned)ac_v * factors[i]) >> 4;
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[]
2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
@ 2023-07-23 18:03 ` Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL Michael Niedermayer
` (3 subsequent siblings)
4 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:03 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Fixes: out of array access
Fixes: 59999/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5767982157266944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mpeg4videodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 30aec5e529..b7fab5a4df 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -295,7 +295,7 @@ void ff_mpeg4_decode_studio(MpegEncContext *s, uint8_t *dest_y, uint8_t *dest_cb
int hsub = i ? s->chroma_x_shift : 0;
int lowres = s->avctx->lowres;
int step = 1 << lowres;
- dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub) - 1);
+ dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub + lowres) - 1);
for (int h = (16 >> (vsub + lowres)) - 1; h >= 0; h--){
for (int w = (16 >> (hsub + lowres)) - 1, idx = 0; w >= 0; w--, idx += step)
dest_pcm[i][w] = src[idx];
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL
2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[] Michael Niedermayer
@ 2023-07-23 18:03 ` Michael Niedermayer
2023-07-23 19:55 ` Pierre-Anthony Lemieux
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy() Michael Niedermayer
` (2 subsequent siblings)
4 siblings, 1 reply; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:03 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Fixes: NULL pointer dereference
Fixes: 60166/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5998301577871360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/imf_cpl.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c
index fe975c2f0c..69155d786d 100644
--- a/libavformat/imf_cpl.c
+++ b/libavformat/imf_cpl.c
@@ -75,6 +75,8 @@ int ff_imf_xml_read_uuid(xmlNodePtr element, AVUUID uuid)
int ret = 0;
xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
+ if (!element_text)
+ return AVERROR_INVALIDDATA;
ret = av_uuid_urn_parse(element_text, uuid);
if (ret)
ret = AVERROR_INVALIDDATA;
@@ -88,7 +90,7 @@ int ff_imf_xml_read_rational(xmlNodePtr element, AVRational *rational)
int ret = 0;
xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
- if (sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
+ if (element_text == NULL || sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
ret = AVERROR_INVALIDDATA;
xmlFree(element_text);
@@ -100,7 +102,7 @@ int ff_imf_xml_read_uint32(xmlNodePtr element, uint32_t *number)
int ret = 0;
xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
- if (sscanf(element_text, "%" PRIu32, number) != 1)
+ if (element_text == NULL || sscanf(element_text, "%" PRIu32, number) != 1)
ret = AVERROR_INVALIDDATA;
xmlFree(element_text);
@@ -245,6 +247,8 @@ static int fill_timecode(xmlNodePtr cpl_element, FFIMFCPL *cpl)
return AVERROR_INVALIDDATA;
tc_str = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
+ if (!tc_str)
+ return AVERROR_INVALIDDATA;
ret = parse_cpl_tc_type(tc_str, comps);
xmlFree(tc_str);
if (ret)
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy()
2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[] Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL Michael Niedermayer
@ 2023-07-23 18:03 ` Michael Niedermayer
2023-09-07 22:09 ` Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units Michael Niedermayer
2023-09-07 22:12 ` [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
4 siblings, 1 reply; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:03 UTC (permalink / raw)
To: FFmpeg development discussions and patches
There is likely a better way to fix this, this is mainly to show the problem
Fixes: MC within same frame resulting in overlapping memcpy()
Fixes: 60189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4992746590175232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/hevcdec.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
index fcf19b4eb6..1536fa5b4b 100644
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -1563,7 +1563,8 @@ static void luma_mc_uni(HEVCLocalContext *lc, uint8_t *dst, ptrdiff_t dststride,
if (x_off < QPEL_EXTRA_BEFORE || y_off < QPEL_EXTRA_AFTER ||
x_off >= pic_width - block_w - QPEL_EXTRA_AFTER ||
- y_off >= pic_height - block_h - QPEL_EXTRA_AFTER) {
+ y_off >= pic_height - block_h - QPEL_EXTRA_AFTER ||
+ ref == s->frame) {
const ptrdiff_t edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
int offset = QPEL_EXTRA_BEFORE * srcstride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
int buf_offset = QPEL_EXTRA_BEFORE * edge_emu_stride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
@@ -1713,6 +1714,7 @@ static void chroma_mc_uni(HEVCLocalContext *lc, uint8_t *dst0,
intptr_t my = av_mod_uintp2(mv->y, 2 + vshift);
intptr_t _mx = mx << (1 - hshift);
intptr_t _my = my << (1 - vshift);
+ int emu = src0 == s->frame->data[1] || src0 == s->frame->data[2];
x_off += mv->x >> (2 + hshift);
y_off += mv->y >> (2 + vshift);
@@ -1720,7 +1722,8 @@ static void chroma_mc_uni(HEVCLocalContext *lc, uint8_t *dst0,
if (x_off < EPEL_EXTRA_BEFORE || y_off < EPEL_EXTRA_AFTER ||
x_off >= pic_width - block_w - EPEL_EXTRA_AFTER ||
- y_off >= pic_height - block_h - EPEL_EXTRA_AFTER) {
+ y_off >= pic_height - block_h - EPEL_EXTRA_AFTER ||
+ emu) {
const int edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
int offset0 = EPEL_EXTRA_BEFORE * (srcstride + (1 << s->ps.sps->pixel_shift));
int buf_offset0 = EPEL_EXTRA_BEFORE *
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units
2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
` (2 preceding siblings ...)
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy() Michael Niedermayer
@ 2023-07-23 18:03 ` Michael Niedermayer
2023-07-23 18:07 ` James Almer
2023-09-07 22:12 ` [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
4 siblings, 1 reply; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:03 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Fixes: NULL pointer dereference
Fixes: 60269/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-5215449416335360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/h266_metadata_bsf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/h266_metadata_bsf.c b/libavcodec/h266_metadata_bsf.c
index c0dbf8ef96..1f0f875cfe 100644
--- a/libavcodec/h266_metadata_bsf.c
+++ b/libavcodec/h266_metadata_bsf.c
@@ -43,7 +43,7 @@ static int h266_metadata_update_fragment(AVBSFContext *bsf, AVPacket *pkt,
int err, i;
// If an AUD is present, it must be the first NAL unit.
- if (pu->units[0].type == VVC_AUD_NUT) {
+ if (pu->nb_units && pu->units[0].type == VVC_AUD_NUT) {
if (ctx->aud == BSF_ELEMENT_REMOVE)
ff_cbs_delete_unit(pu, 0);
} else if ( pkt && ctx->aud == BSF_ELEMENT_INSERT) {
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units Michael Niedermayer
@ 2023-07-23 18:07 ` James Almer
2023-07-23 18:08 ` Michael Niedermayer
0 siblings, 1 reply; 11+ messages in thread
From: James Almer @ 2023-07-23 18:07 UTC (permalink / raw)
To: ffmpeg-devel
On 7/23/2023 3:03 PM, Michael Niedermayer wrote:
> Fixes: NULL pointer dereference
> Fixes: 60269/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-5215449416335360
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavcodec/h266_metadata_bsf.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/h266_metadata_bsf.c b/libavcodec/h266_metadata_bsf.c
> index c0dbf8ef96..1f0f875cfe 100644
> --- a/libavcodec/h266_metadata_bsf.c
> +++ b/libavcodec/h266_metadata_bsf.c
> @@ -43,7 +43,7 @@ static int h266_metadata_update_fragment(AVBSFContext *bsf, AVPacket *pkt,
> int err, i;
>
> // If an AUD is present, it must be the first NAL unit.
> - if (pu->units[0].type == VVC_AUD_NUT) {
> + if (pu->nb_units && pu->units[0].type == VVC_AUD_NUT) {
> if (ctx->aud == BSF_ELEMENT_REMOVE)
> ff_cbs_delete_unit(pu, 0);
> } else if ( pkt && ctx->aud == BSF_ELEMENT_INSERT) {
Should be ok.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units
2023-07-23 18:07 ` James Almer
@ 2023-07-23 18:08 ` Michael Niedermayer
0 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:08 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 1426 bytes --]
On Sun, Jul 23, 2023 at 03:07:32PM -0300, James Almer wrote:
> On 7/23/2023 3:03 PM, Michael Niedermayer wrote:
> > Fixes: NULL pointer dereference
> > Fixes: 60269/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-5215449416335360
> >
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavcodec/h266_metadata_bsf.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/libavcodec/h266_metadata_bsf.c b/libavcodec/h266_metadata_bsf.c
> > index c0dbf8ef96..1f0f875cfe 100644
> > --- a/libavcodec/h266_metadata_bsf.c
> > +++ b/libavcodec/h266_metadata_bsf.c
> > @@ -43,7 +43,7 @@ static int h266_metadata_update_fragment(AVBSFContext *bsf, AVPacket *pkt,
> > int err, i;
> > // If an AUD is present, it must be the first NAL unit.
> > - if (pu->units[0].type == VVC_AUD_NUT) {
> > + if (pu->nb_units && pu->units[0].type == VVC_AUD_NUT) {
> > if (ctx->aud == BSF_ELEMENT_REMOVE)
> > ff_cbs_delete_unit(pu, 0);
> > } else if ( pkt && ctx->aud == BSF_ELEMENT_INSERT) {
>
> Should be ok.
will apply
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
The worst form of inequality is to try to make unequal things equal.
-- Aristotle
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL Michael Niedermayer
@ 2023-07-23 19:55 ` Pierre-Anthony Lemieux
2023-07-23 21:21 ` Michael Niedermayer
0 siblings, 1 reply; 11+ messages in thread
From: Pierre-Anthony Lemieux @ 2023-07-23 19:55 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Would this patch be an opportunity to set `cpl->content_title_utf8` to
an empty string at fill_content_title() at libavformat/imf_cpl.c if
xmlNodeListGetString() returns NULL? It could be done as a separate
patch alternatively.
LGTM otherwise.
On Sun, Jul 23, 2023 at 11:03 AM Michael Niedermayer
<michael@niedermayer.cc> wrote:
>
> Fixes: NULL pointer dereference
> Fixes: 60166/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5998301577871360
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavformat/imf_cpl.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c
> index fe975c2f0c..69155d786d 100644
> --- a/libavformat/imf_cpl.c
> +++ b/libavformat/imf_cpl.c
> @@ -75,6 +75,8 @@ int ff_imf_xml_read_uuid(xmlNodePtr element, AVUUID uuid)
> int ret = 0;
>
> xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
> + if (!element_text)
> + return AVERROR_INVALIDDATA;
> ret = av_uuid_urn_parse(element_text, uuid);
> if (ret)
> ret = AVERROR_INVALIDDATA;
> @@ -88,7 +90,7 @@ int ff_imf_xml_read_rational(xmlNodePtr element, AVRational *rational)
> int ret = 0;
>
> xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
> - if (sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
> + if (element_text == NULL || sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
> ret = AVERROR_INVALIDDATA;
> xmlFree(element_text);
>
> @@ -100,7 +102,7 @@ int ff_imf_xml_read_uint32(xmlNodePtr element, uint32_t *number)
> int ret = 0;
>
> xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
> - if (sscanf(element_text, "%" PRIu32, number) != 1)
> + if (element_text == NULL || sscanf(element_text, "%" PRIu32, number) != 1)
> ret = AVERROR_INVALIDDATA;
> xmlFree(element_text);
>
> @@ -245,6 +247,8 @@ static int fill_timecode(xmlNodePtr cpl_element, FFIMFCPL *cpl)
> return AVERROR_INVALIDDATA;
>
> tc_str = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
> + if (!tc_str)
> + return AVERROR_INVALIDDATA;
> ret = parse_cpl_tc_type(tc_str, comps);
> xmlFree(tc_str);
> if (ret)
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL
2023-07-23 19:55 ` Pierre-Anthony Lemieux
@ 2023-07-23 21:21 ` Michael Niedermayer
0 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 21:21 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 629 bytes --]
On Sun, Jul 23, 2023 at 12:55:46PM -0700, Pierre-Anthony Lemieux wrote:
> Would this patch be an opportunity to set `cpl->content_title_utf8` to
> an empty string at fill_content_title() at libavformat/imf_cpl.c if
> xmlNodeListGetString() returns NULL? It could be done as a separate
> patch alternatively.
ill send a seperate patch for this
>
> LGTM otherwise.
will apply
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
If a bugfix only changes things apparently unrelated to the bug with no
further explanation, that is a good sign that the bugfix is wrong.
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy()
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy() Michael Niedermayer
@ 2023-09-07 22:09 ` Michael Niedermayer
0 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-09-07 22:09 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 887 bytes --]
On Sun, Jul 23, 2023 at 08:03:02PM +0200, Michael Niedermayer wrote:
> There is likely a better way to fix this, this is mainly to show the problem
>
> Fixes: MC within same frame resulting in overlapping memcpy()
> Fixes: 60189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4992746590175232
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavcodec/hevcdec.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
this fixes 2 more files
will apply with all 3 in the commit message
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
No human being will ever know the Truth, for even if they happen to say it
by chance, they would not even known they had done so. -- Xenophanes
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac()
2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
` (3 preceding siblings ...)
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units Michael Niedermayer
@ 2023-09-07 22:12 ` Michael Niedermayer
4 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-09-07 22:12 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 685 bytes --]
On Sun, Jul 23, 2023 at 08:02:59PM +0200, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 59952/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-6718213736759296
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavcodec/vmixdec.c | 4 ++++
> 1 file changed, 4 insertions(+)
will apply 1/5 and 2/5
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
Does the universe only have a finite lifespan? No, its going to go on
forever, its just that you wont like living in it. -- Hiranya Peiri
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2023-09-07 22:12 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[] Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL Michael Niedermayer
2023-07-23 19:55 ` Pierre-Anthony Lemieux
2023-07-23 21:21 ` Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy() Michael Niedermayer
2023-09-07 22:09 ` Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units Michael Niedermayer
2023-07-23 18:07 ` James Almer
2023-07-23 18:08 ` Michael Niedermayer
2023-09-07 22:12 ` [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git