Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
 help / color / mirror / Atom feed
* [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac()
@ 2023-07-23 18:02 Michael Niedermayer
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[] Michael Niedermayer
                   ` (4 more replies)
  0 siblings, 5 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:02 UTC (permalink / raw)
  To: FFmpeg development discussions and patches

Fixes: Timeout
Fixes: 59952/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-6718213736759296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/vmixdec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/vmixdec.c b/libavcodec/vmixdec.c
index b77c90929a..4cc5963e25 100644
--- a/libavcodec/vmixdec.c
+++ b/libavcodec/vmixdec.c
@@ -115,6 +115,8 @@ static int decode_dcac(AVCodecContext *avctx,
             if (dc_run > 0) {
                 dc_run--;
             } else {
+                if (get_bits_left(dc_gb) < 1)
+                    return AVERROR_INVALIDDATA;
                 dc_v = get_se_golomb_vmix(dc_gb);
                 dc += (unsigned)dc_v;
                 if (!dc_v)
@@ -127,6 +129,8 @@ static int decode_dcac(AVCodecContext *avctx,
                     continue;
                 }
 
+                if (get_bits_left(ac_gb) < 1)
+                    return AVERROR_INVALIDDATA;
                 ac_v = get_se_golomb_vmix(ac_gb);
                 i = scan[n];
                 block[i] = ((unsigned)ac_v * factors[i]) >> 4;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[]
  2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
@ 2023-07-23 18:03 ` Michael Niedermayer
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL Michael Niedermayer
                   ` (3 subsequent siblings)
  4 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:03 UTC (permalink / raw)
  To: FFmpeg development discussions and patches

Fixes: out of array access
Fixes: 59999/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5767982157266944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/mpeg4videodec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 30aec5e529..b7fab5a4df 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -295,7 +295,7 @@ void ff_mpeg4_decode_studio(MpegEncContext *s, uint8_t *dest_y, uint8_t *dest_cb
             int hsub = i ? s->chroma_x_shift : 0;
             int lowres = s->avctx->lowres;
             int step = 1 << lowres;
-            dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub) - 1);
+            dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub + lowres) - 1);
             for (int h = (16 >> (vsub + lowres)) - 1; h >= 0; h--){
                 for (int w = (16 >> (hsub + lowres)) - 1, idx = 0; w >= 0; w--, idx += step)
                     dest_pcm[i][w] = src[idx];
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL
  2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[] Michael Niedermayer
@ 2023-07-23 18:03 ` Michael Niedermayer
  2023-07-23 19:55   ` Pierre-Anthony Lemieux
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy() Michael Niedermayer
                   ` (2 subsequent siblings)
  4 siblings, 1 reply; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:03 UTC (permalink / raw)
  To: FFmpeg development discussions and patches

Fixes: NULL pointer dereference
Fixes: 60166/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5998301577871360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/imf_cpl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c
index fe975c2f0c..69155d786d 100644
--- a/libavformat/imf_cpl.c
+++ b/libavformat/imf_cpl.c
@@ -75,6 +75,8 @@ int ff_imf_xml_read_uuid(xmlNodePtr element, AVUUID uuid)
     int ret = 0;
 
     xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
+    if (!element_text)
+        return AVERROR_INVALIDDATA;
     ret = av_uuid_urn_parse(element_text, uuid);
     if (ret)
         ret = AVERROR_INVALIDDATA;
@@ -88,7 +90,7 @@ int ff_imf_xml_read_rational(xmlNodePtr element, AVRational *rational)
     int ret = 0;
 
     xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
-    if (sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
+    if (element_text == NULL || sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
         ret = AVERROR_INVALIDDATA;
     xmlFree(element_text);
 
@@ -100,7 +102,7 @@ int ff_imf_xml_read_uint32(xmlNodePtr element, uint32_t *number)
     int ret = 0;
 
     xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
-    if (sscanf(element_text, "%" PRIu32, number) != 1)
+    if (element_text == NULL || sscanf(element_text, "%" PRIu32, number) != 1)
         ret = AVERROR_INVALIDDATA;
     xmlFree(element_text);
 
@@ -245,6 +247,8 @@ static int fill_timecode(xmlNodePtr cpl_element, FFIMFCPL *cpl)
         return AVERROR_INVALIDDATA;
 
     tc_str = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
+    if (!tc_str)
+        return AVERROR_INVALIDDATA;
     ret = parse_cpl_tc_type(tc_str, comps);
     xmlFree(tc_str);
     if (ret)
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy()
  2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[] Michael Niedermayer
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL Michael Niedermayer
@ 2023-07-23 18:03 ` Michael Niedermayer
  2023-09-07 22:09   ` Michael Niedermayer
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units Michael Niedermayer
  2023-09-07 22:12 ` [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
  4 siblings, 1 reply; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:03 UTC (permalink / raw)
  To: FFmpeg development discussions and patches

There is likely a better way to fix this, this is mainly to show the problem

Fixes: MC within same frame resulting in overlapping memcpy()
Fixes: 60189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4992746590175232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/hevcdec.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
index fcf19b4eb6..1536fa5b4b 100644
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -1563,7 +1563,8 @@ static void luma_mc_uni(HEVCLocalContext *lc, uint8_t *dst, ptrdiff_t dststride,
 
     if (x_off < QPEL_EXTRA_BEFORE || y_off < QPEL_EXTRA_AFTER ||
         x_off >= pic_width - block_w - QPEL_EXTRA_AFTER ||
-        y_off >= pic_height - block_h - QPEL_EXTRA_AFTER) {
+        y_off >= pic_height - block_h - QPEL_EXTRA_AFTER ||
+        ref == s->frame) {
         const ptrdiff_t edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
         int offset     = QPEL_EXTRA_BEFORE * srcstride       + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
         int buf_offset = QPEL_EXTRA_BEFORE * edge_emu_stride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
@@ -1713,6 +1714,7 @@ static void chroma_mc_uni(HEVCLocalContext *lc, uint8_t *dst0,
     intptr_t my          = av_mod_uintp2(mv->y, 2 + vshift);
     intptr_t _mx         = mx << (1 - hshift);
     intptr_t _my         = my << (1 - vshift);
+    int emu              = src0 == s->frame->data[1] || src0 == s->frame->data[2];
 
     x_off += mv->x >> (2 + hshift);
     y_off += mv->y >> (2 + vshift);
@@ -1720,7 +1722,8 @@ static void chroma_mc_uni(HEVCLocalContext *lc, uint8_t *dst0,
 
     if (x_off < EPEL_EXTRA_BEFORE || y_off < EPEL_EXTRA_AFTER ||
         x_off >= pic_width - block_w - EPEL_EXTRA_AFTER ||
-        y_off >= pic_height - block_h - EPEL_EXTRA_AFTER) {
+        y_off >= pic_height - block_h - EPEL_EXTRA_AFTER ||
+        emu) {
         const int edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
         int offset0 = EPEL_EXTRA_BEFORE * (srcstride + (1 << s->ps.sps->pixel_shift));
         int buf_offset0 = EPEL_EXTRA_BEFORE *
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units
  2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
                   ` (2 preceding siblings ...)
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy() Michael Niedermayer
@ 2023-07-23 18:03 ` Michael Niedermayer
  2023-07-23 18:07   ` James Almer
  2023-09-07 22:12 ` [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
  4 siblings, 1 reply; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:03 UTC (permalink / raw)
  To: FFmpeg development discussions and patches

Fixes: NULL pointer dereference
Fixes: 60269/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-5215449416335360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/h266_metadata_bsf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/h266_metadata_bsf.c b/libavcodec/h266_metadata_bsf.c
index c0dbf8ef96..1f0f875cfe 100644
--- a/libavcodec/h266_metadata_bsf.c
+++ b/libavcodec/h266_metadata_bsf.c
@@ -43,7 +43,7 @@ static int h266_metadata_update_fragment(AVBSFContext *bsf, AVPacket *pkt,
     int err, i;
 
     // If an AUD is present, it must be the first NAL unit.
-    if (pu->units[0].type == VVC_AUD_NUT) {
+    if (pu->nb_units && pu->units[0].type == VVC_AUD_NUT) {
         if (ctx->aud == BSF_ELEMENT_REMOVE)
             ff_cbs_delete_unit(pu, 0);
     } else if ( pkt && ctx->aud == BSF_ELEMENT_INSERT) {
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units Michael Niedermayer
@ 2023-07-23 18:07   ` James Almer
  2023-07-23 18:08     ` Michael Niedermayer
  0 siblings, 1 reply; 11+ messages in thread
From: James Almer @ 2023-07-23 18:07 UTC (permalink / raw)
  To: ffmpeg-devel

On 7/23/2023 3:03 PM, Michael Niedermayer wrote:
> Fixes: NULL pointer dereference
> Fixes: 60269/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-5215449416335360
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavcodec/h266_metadata_bsf.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/h266_metadata_bsf.c b/libavcodec/h266_metadata_bsf.c
> index c0dbf8ef96..1f0f875cfe 100644
> --- a/libavcodec/h266_metadata_bsf.c
> +++ b/libavcodec/h266_metadata_bsf.c
> @@ -43,7 +43,7 @@ static int h266_metadata_update_fragment(AVBSFContext *bsf, AVPacket *pkt,
>       int err, i;
>   
>       // If an AUD is present, it must be the first NAL unit.
> -    if (pu->units[0].type == VVC_AUD_NUT) {
> +    if (pu->nb_units && pu->units[0].type == VVC_AUD_NUT) {
>           if (ctx->aud == BSF_ELEMENT_REMOVE)
>               ff_cbs_delete_unit(pu, 0);
>       } else if ( pkt && ctx->aud == BSF_ELEMENT_INSERT) {

Should be ok.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units
  2023-07-23 18:07   ` James Almer
@ 2023-07-23 18:08     ` Michael Niedermayer
  0 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 18:08 UTC (permalink / raw)
  To: FFmpeg development discussions and patches


[-- Attachment #1.1: Type: text/plain, Size: 1426 bytes --]

On Sun, Jul 23, 2023 at 03:07:32PM -0300, James Almer wrote:
> On 7/23/2023 3:03 PM, Michael Niedermayer wrote:
> > Fixes: NULL pointer dereference
> > Fixes: 60269/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-5215449416335360
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >   libavcodec/h266_metadata_bsf.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/h266_metadata_bsf.c b/libavcodec/h266_metadata_bsf.c
> > index c0dbf8ef96..1f0f875cfe 100644
> > --- a/libavcodec/h266_metadata_bsf.c
> > +++ b/libavcodec/h266_metadata_bsf.c
> > @@ -43,7 +43,7 @@ static int h266_metadata_update_fragment(AVBSFContext *bsf, AVPacket *pkt,
> >       int err, i;
> >       // If an AUD is present, it must be the first NAL unit.
> > -    if (pu->units[0].type == VVC_AUD_NUT) {
> > +    if (pu->nb_units && pu->units[0].type == VVC_AUD_NUT) {
> >           if (ctx->aud == BSF_ELEMENT_REMOVE)
> >               ff_cbs_delete_unit(pu, 0);
> >       } else if ( pkt && ctx->aud == BSF_ELEMENT_INSERT) {
> 
> Should be ok.

will apply

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The worst form of inequality is to try to make unequal things equal.
-- Aristotle

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL Michael Niedermayer
@ 2023-07-23 19:55   ` Pierre-Anthony Lemieux
  2023-07-23 21:21     ` Michael Niedermayer
  0 siblings, 1 reply; 11+ messages in thread
From: Pierre-Anthony Lemieux @ 2023-07-23 19:55 UTC (permalink / raw)
  To: FFmpeg development discussions and patches

Would this patch be an opportunity to set `cpl->content_title_utf8` to
an empty string at fill_content_title() at libavformat/imf_cpl.c if
xmlNodeListGetString() returns NULL? It could be done as a separate
patch alternatively.

LGTM otherwise.


On Sun, Jul 23, 2023 at 11:03 AM Michael Niedermayer
<michael@niedermayer.cc> wrote:
>
> Fixes: NULL pointer dereference
> Fixes: 60166/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5998301577871360
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/imf_cpl.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c
> index fe975c2f0c..69155d786d 100644
> --- a/libavformat/imf_cpl.c
> +++ b/libavformat/imf_cpl.c
> @@ -75,6 +75,8 @@ int ff_imf_xml_read_uuid(xmlNodePtr element, AVUUID uuid)
>      int ret = 0;
>
>      xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
> +    if (!element_text)
> +        return AVERROR_INVALIDDATA;
>      ret = av_uuid_urn_parse(element_text, uuid);
>      if (ret)
>          ret = AVERROR_INVALIDDATA;
> @@ -88,7 +90,7 @@ int ff_imf_xml_read_rational(xmlNodePtr element, AVRational *rational)
>      int ret = 0;
>
>      xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
> -    if (sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
> +    if (element_text == NULL || sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
>          ret = AVERROR_INVALIDDATA;
>      xmlFree(element_text);
>
> @@ -100,7 +102,7 @@ int ff_imf_xml_read_uint32(xmlNodePtr element, uint32_t *number)
>      int ret = 0;
>
>      xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
> -    if (sscanf(element_text, "%" PRIu32, number) != 1)
> +    if (element_text == NULL || sscanf(element_text, "%" PRIu32, number) != 1)
>          ret = AVERROR_INVALIDDATA;
>      xmlFree(element_text);
>
> @@ -245,6 +247,8 @@ static int fill_timecode(xmlNodePtr cpl_element, FFIMFCPL *cpl)
>          return AVERROR_INVALIDDATA;
>
>      tc_str = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
> +    if (!tc_str)
> +        return AVERROR_INVALIDDATA;
>      ret = parse_cpl_tc_type(tc_str, comps);
>      xmlFree(tc_str);
>      if (ret)
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL
  2023-07-23 19:55   ` Pierre-Anthony Lemieux
@ 2023-07-23 21:21     ` Michael Niedermayer
  0 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-07-23 21:21 UTC (permalink / raw)
  To: FFmpeg development discussions and patches


[-- Attachment #1.1: Type: text/plain, Size: 629 bytes --]

On Sun, Jul 23, 2023 at 12:55:46PM -0700, Pierre-Anthony Lemieux wrote:
> Would this patch be an opportunity to set `cpl->content_title_utf8` to
> an empty string at fill_content_title() at libavformat/imf_cpl.c if
> xmlNodeListGetString() returns NULL? It could be done as a separate
> patch alternatively.

ill send a seperate patch for this


> 
> LGTM otherwise.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If a bugfix only changes things apparently unrelated to the bug with no
further explanation, that is a good sign that the bugfix is wrong.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy()
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy() Michael Niedermayer
@ 2023-09-07 22:09   ` Michael Niedermayer
  0 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-09-07 22:09 UTC (permalink / raw)
  To: FFmpeg development discussions and patches


[-- Attachment #1.1: Type: text/plain, Size: 887 bytes --]

On Sun, Jul 23, 2023 at 08:03:02PM +0200, Michael Niedermayer wrote:
> There is likely a better way to fix this, this is mainly to show the problem
> 
> Fixes: MC within same frame resulting in overlapping memcpy()
> Fixes: 60189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4992746590175232
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/hevcdec.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)

this fixes 2 more files
will apply with all 3 in the commit message

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

No human being will ever know the Truth, for even if they happen to say it
by chance, they would not even known they had done so. -- Xenophanes

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac()
  2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
                   ` (3 preceding siblings ...)
  2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units Michael Niedermayer
@ 2023-09-07 22:12 ` Michael Niedermayer
  4 siblings, 0 replies; 11+ messages in thread
From: Michael Niedermayer @ 2023-09-07 22:12 UTC (permalink / raw)
  To: FFmpeg development discussions and patches


[-- Attachment #1.1: Type: text/plain, Size: 685 bytes --]

On Sun, Jul 23, 2023 at 08:02:59PM +0200, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 59952/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-6718213736759296
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/vmixdec.c | 4 ++++
>  1 file changed, 4 insertions(+)

will apply 1/5 and 2/5

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Does the universe only have a finite lifespan? No, its going to go on
forever, its just that you wont like living in it. -- Hiranya Peiri

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2023-09-07 22:12 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-23 18:02 [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: consider lowres in dest_pcm[] Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 3/5] avformat/imf_cpl: xmlNodeListGetString() can return NULL Michael Niedermayer
2023-07-23 19:55   ` Pierre-Anthony Lemieux
2023-07-23 21:21     ` Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Fix undefined memcpy() Michael Niedermayer
2023-09-07 22:09   ` Michael Niedermayer
2023-07-23 18:03 ` [FFmpeg-devel] [PATCH 5/5] avcodec/h266_metadata_bsf: Check if there are CodedBitstreamFragment units Michael Niedermayer
2023-07-23 18:07   ` James Almer
2023-07-23 18:08     ` Michael Niedermayer
2023-09-07 22:12 ` [FFmpeg-devel] [PATCH 1/5] avcodec/vmixdec: Check for end of input in decode_dcac() Michael Niedermayer

Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
		ffmpegdev@gitmailbox.com
	public-inbox-index ffmpegdev

Example config snippet for mirrors.


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git