[FFmpeg-devel] [PATCH 1/4] avcodec/evc_ps: Check cpb_cnt_minus1 and propagate error

[FFmpeg-devel] [PATCH 1/4] avcodec/evc_ps: Check cpb_cnt_minus1 and propagate error

[Michael Niedermayer]

Fixes: out of array access
Fixes: 60949/clusterfuzz-testcase-minimized-ffmpeg_dem_EVC_fuzzer-5959738853294080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/evc_ps.c | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c
index 64384a392c2..7fe13fd32f0 100644
--- a/libavcodec/evc_ps.c
+++ b/libavcodec/evc_ps.c
@@ -53,6 +53,9 @@ static int ref_pic_list_struct(GetBitContext *gb, RefPicListStruct *rpl)
 static int hrd_parameters(GetBitContext *gb, HRDParameters *hrd)
 {
     hrd->cpb_cnt_minus1 = get_ue_golomb_31(gb);
+    if (hrd->cpb_cnt_minus1 >= FF_ARRAY_ELEMS(hrd->cpb_size_value_minus1))
+        return AVERROR_INVALIDDATA;
+
     hrd->bit_rate_scale = get_bits(gb, 4);
     hrd->cpb_size_scale = get_bits(gb, 4);
     for (int SchedSelIdx = 0; SchedSelIdx <= hrd->cpb_cnt_minus1; SchedSelIdx++) {
@@ -71,6 +74,8 @@ static int hrd_parameters(GetBitContext *gb, HRDParameters *hrd)
 // @see  ISO_IEC_23094-1 (E.2.1 VUI parameters syntax)
 static int vui_parameters(GetBitContext *gb, VUIParameters *vui)
 {
+    int ret;
+
     vui->aspect_ratio_info_present_flag = get_bits(gb, 1);
     if (vui->aspect_ratio_info_present_flag) {
         vui->aspect_ratio_idc = get_bits(gb, 8);
@@ -109,11 +114,18 @@ static int vui_parameters(GetBitContext *gb, VUIParameters *vui)
         vui->fixed_pic_rate_flag = get_bits(gb, 1);
     }
     vui->nal_hrd_parameters_present_flag = get_bits(gb, 1);
-    if (vui->nal_hrd_parameters_present_flag)
-        hrd_parameters(gb, &vui->hrd_parameters);
+    if (vui->nal_hrd_parameters_present_flag) {
+        ret = hrd_parameters(gb, &vui->hrd_parameters);
+        if (ret < 0)
+            return ret;
+    }
+
     vui->vcl_hrd_parameters_present_flag = get_bits(gb, 1);
-    if (vui->vcl_hrd_parameters_present_flag)
-        hrd_parameters(gb, &vui->hrd_parameters);
+    if (vui->vcl_hrd_parameters_present_flag) {
+        ret = hrd_parameters(gb, &vui->hrd_parameters);
+        if (ret < 0)
+            return ret;
+    }
     if (vui->nal_hrd_parameters_present_flag || vui->vcl_hrd_parameters_present_flag)
         vui->low_delay_hrd_flag = get_bits(gb, 1);
     vui->pic_struct_present_flag = get_bits(gb, 1);
@@ -292,8 +304,11 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
     }
 
     sps->vui_parameters_present_flag = get_bits1(gb);
-    if (sps->vui_parameters_present_flag)
-        vui_parameters(gb, &(sps->vui_parameters));
+    if (sps->vui_parameters_present_flag) {
+        ret = vui_parameters(gb, &(sps->vui_parameters));
+        if (ret < 0)
+            goto fail;
+    }
 
     // @note
     // If necessary, add the missing fields to the EVCParserSPS structure
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/4] avcodec/evc_ps: Check ref_pic_num and sps_max_dec_pic_buffering_minus1

[Michael Niedermayer]

Fixes: out of array write

Found-by: dongsookim@korea.ac.kr
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/evc_ps.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c
index 7fe13fd32f0..96237ed2911 100644
--- a/libavcodec/evc_ps.c
+++ b/libavcodec/evc_ps.c
@@ -22,12 +22,15 @@
 #include "evc_ps.h"
 
 #define EXTENDED_SAR 255
-
 // @see ISO_IEC_23094-1 (7.3.7 Reference picture list structure syntax)
-static int ref_pic_list_struct(GetBitContext *gb, RefPicListStruct *rpl)
+static int ref_pic_list_struct(EVCParserSPS *sps, GetBitContext *gb, RefPicListStruct *rpl)
 {
     uint32_t delta_poc_st, strp_entry_sign_flag = 0;
     rpl->ref_pic_num = get_ue_golomb_long(gb);
+
+    if ((unsigned)rpl->ref_pic_num  > sps->sps_max_dec_pic_buffering_minus1)
+        return AVERROR_INVALIDDATA;
+
     if (rpl->ref_pic_num > 0) {
         delta_poc_st = get_ue_golomb_long(gb);
 
@@ -251,6 +254,8 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
         sps->max_num_tid0_ref_pics = get_ue_golomb_31(gb);
     else {
         sps->sps_max_dec_pic_buffering_minus1 = get_ue_golomb_long(gb);
+        if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1)
+            return AVERROR_INVALIDDATA;
         sps->long_term_ref_pic_flag = get_bits1(gb);
         sps->rpl1_same_as_rpl0_flag = get_bits1(gb);
         sps->num_ref_pic_list_in_sps[0] = get_ue_golomb(gb);
@@ -261,7 +266,7 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
         }
 
         for (int i = 0; i < sps->num_ref_pic_list_in_sps[0]; ++i)
-            ref_pic_list_struct(gb, &sps->rpls[0][i]);
+            ref_pic_list_struct(sps, gb, &sps->rpls[0][i]);
 
         if (!sps->rpl1_same_as_rpl0_flag) {
             sps->num_ref_pic_list_in_sps[1] = get_ue_golomb(gb);
@@ -270,7 +275,7 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
                 goto fail;
             }
             for (int i = 0; i < sps->num_ref_pic_list_in_sps[1]; ++i)
-                ref_pic_list_struct(gb, &sps->rpls[1][i]);
+                ref_pic_list_struct(sps, gb, &sps->rpls[1][i]);
         }
     }
 
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/4] avcodec/evc_ps: Check ref_pic_num and sps_max_dec_pic_buffering_minus1

[James Almer]

On 9/15/2023 10:11 AM, Michael Niedermayer wrote:
> Fixes: out of array write
> 
> Found-by: dongsookim@korea.ac.kr
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavcodec/evc_ps.c | 13 +++++++++----
>   1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c
> index 7fe13fd32f0..96237ed2911 100644
> --- a/libavcodec/evc_ps.c
> +++ b/libavcodec/evc_ps.c
> @@ -22,12 +22,15 @@
>   #include "evc_ps.h"
>   
>   #define EXTENDED_SAR 255
> -
>   // @see ISO_IEC_23094-1 (7.3.7 Reference picture list structure syntax)
> -static int ref_pic_list_struct(GetBitContext *gb, RefPicListStruct *rpl)
> +static int ref_pic_list_struct(EVCParserSPS *sps, GetBitContext *gb, RefPicListStruct *rpl)
>   {
>       uint32_t delta_poc_st, strp_entry_sign_flag = 0;
>       rpl->ref_pic_num = get_ue_golomb_long(gb);
> +
> +    if ((unsigned)rpl->ref_pic_num  > sps->sps_max_dec_pic_buffering_minus1)
> +        return AVERROR_INVALIDDATA;
> +
>       if (rpl->ref_pic_num > 0) {
>           delta_poc_st = get_ue_golomb_long(gb);
>   
> @@ -251,6 +254,8 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
>           sps->max_num_tid0_ref_pics = get_ue_golomb_31(gb);
>       else {
>           sps->sps_max_dec_pic_buffering_minus1 = get_ue_golomb_long(gb);
> +        if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1)
> +            return AVERROR_INVALIDDATA;
>           sps->long_term_ref_pic_flag = get_bits1(gb);
>           sps->rpl1_same_as_rpl0_flag = get_bits1(gb);
>           sps->num_ref_pic_list_in_sps[0] = get_ue_golomb(gb);
> @@ -261,7 +266,7 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
>           }
>   
>           for (int i = 0; i < sps->num_ref_pic_list_in_sps[0]; ++i)
> -            ref_pic_list_struct(gb, &sps->rpls[0][i]);
> +            ref_pic_list_struct(sps, gb, &sps->rpls[0][i]);

Could check and propagate the error value here while at it.

>   
>           if (!sps->rpl1_same_as_rpl0_flag) {
>               sps->num_ref_pic_list_in_sps[1] = get_ue_golomb(gb);
> @@ -270,7 +275,7 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
>                   goto fail;
>               }
>               for (int i = 0; i < sps->num_ref_pic_list_in_sps[1]; ++i)
> -                ref_pic_list_struct(gb, &sps->rpls[1][i]);
> +                ref_pic_list_struct(sps, gb, &sps->rpls[1][i]);

Ditto.

>           }
>       }
>   

Should be ok.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/4] avcodec/evc_ps: Check ref_pic_num and sps_max_dec_pic_buffering_minus1

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 2947 bytes --]

On Fri, Sep 15, 2023 at 10:57:29AM -0300, James Almer wrote:
> On 9/15/2023 10:11 AM, Michael Niedermayer wrote:
> > Fixes: out of array write
> > 
> > Found-by: dongsookim@korea.ac.kr
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >   libavcodec/evc_ps.c | 13 +++++++++----
> >   1 file changed, 9 insertions(+), 4 deletions(-)
> > 
> > diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c
> > index 7fe13fd32f0..96237ed2911 100644
> > --- a/libavcodec/evc_ps.c
> > +++ b/libavcodec/evc_ps.c
> > @@ -22,12 +22,15 @@
> >   #include "evc_ps.h"
> >   #define EXTENDED_SAR 255
> > -
> >   // @see ISO_IEC_23094-1 (7.3.7 Reference picture list structure syntax)
> > -static int ref_pic_list_struct(GetBitContext *gb, RefPicListStruct *rpl)
> > +static int ref_pic_list_struct(EVCParserSPS *sps, GetBitContext *gb, RefPicListStruct *rpl)
> >   {
> >       uint32_t delta_poc_st, strp_entry_sign_flag = 0;
> >       rpl->ref_pic_num = get_ue_golomb_long(gb);
> > +
> > +    if ((unsigned)rpl->ref_pic_num  > sps->sps_max_dec_pic_buffering_minus1)
> > +        return AVERROR_INVALIDDATA;
> > +
> >       if (rpl->ref_pic_num > 0) {
> >           delta_poc_st = get_ue_golomb_long(gb);
> > @@ -251,6 +254,8 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
> >           sps->max_num_tid0_ref_pics = get_ue_golomb_31(gb);
> >       else {
> >           sps->sps_max_dec_pic_buffering_minus1 = get_ue_golomb_long(gb);
> > +        if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1)
> > +            return AVERROR_INVALIDDATA;
> >           sps->long_term_ref_pic_flag = get_bits1(gb);
> >           sps->rpl1_same_as_rpl0_flag = get_bits1(gb);
> >           sps->num_ref_pic_list_in_sps[0] = get_ue_golomb(gb);
> > @@ -261,7 +266,7 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
> >           }
> >           for (int i = 0; i < sps->num_ref_pic_list_in_sps[0]; ++i)
> > -            ref_pic_list_struct(gb, &sps->rpls[0][i]);
> > +            ref_pic_list_struct(sps, gb, &sps->rpls[0][i]);
> 
> Could check and propagate the error value here while at it.
> 
> >           if (!sps->rpl1_same_as_rpl0_flag) {
> >               sps->num_ref_pic_list_in_sps[1] = get_ue_golomb(gb);
> > @@ -270,7 +275,7 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
> >                   goto fail;
> >               }
> >               for (int i = 0; i < sps->num_ref_pic_list_in_sps[1]; ++i)
> > -                ref_pic_list_struct(gb, &sps->rpls[1][i]);
> > +                ref_pic_list_struct(sps, gb, &sps->rpls[1][i]);
> 
> Ditto.
> 
> >           }
> >       }
> 
> Should be ok.

will apply with these changes

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

"I am not trying to be anyone's saviour, I'm trying to think about the
 future and not be sad" - Elon Musk


[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/4] avutil/tx_template: Fix some signed integer overflows in DECL_FFT5()

[Michael Niedermayer]

Fixes: signed integer overflow: -1364715454 + -1468954671 cannot be represented in type 'int'
Fixes: 62093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5538774254485504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavutil/tx_template.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/libavutil/tx_template.c b/libavutil/tx_template.c
index 6e3b3dad338..8dc3d2519c1 100644
--- a/libavutil/tx_template.c
+++ b/libavutil/tx_template.c
@@ -222,8 +222,8 @@ static av_always_inline void NAME(TXComplex *out, TXComplex *in,    \
     BF(t[3].im, t[2].re, in[2].re, in[3].re);                       \
     BF(t[3].re, t[2].im, in[2].im, in[3].im);                       \
                                                                     \
-    out[D0*stride].re = dc.re + t[0].re + t[2].re;                  \
-    out[D0*stride].im = dc.im + t[0].im + t[2].im;                  \
+    out[D0*stride].re = dc.re + (TXUSample)t[0].re + t[2].re;        \
+    out[D0*stride].im = dc.im + (TXUSample)t[0].im + t[2].im;        \
                                                                     \
     SMUL(t[4].re, t[0].re, tab[0], tab[2], t[2].re, t[0].re);       \
     SMUL(t[4].im, t[0].im, tab[0], tab[2], t[2].im, t[0].im);       \
@@ -235,14 +235,14 @@ static av_always_inline void NAME(TXComplex *out, TXComplex *in,    \
     BF(z0[2].re, z0[1].re, t[4].re, t[5].re);                       \
     BF(z0[2].im, z0[1].im, t[4].im, t[5].im);                       \
                                                                     \
-    out[D1*stride].re = dc.re + z0[3].re;                           \
-    out[D1*stride].im = dc.im + z0[0].im;                           \
-    out[D2*stride].re = dc.re + z0[2].re;                           \
-    out[D2*stride].im = dc.im + z0[1].im;                           \
-    out[D3*stride].re = dc.re + z0[1].re;                           \
-    out[D3*stride].im = dc.im + z0[2].im;                           \
-    out[D4*stride].re = dc.re + z0[0].re;                           \
-    out[D4*stride].im = dc.im + z0[3].im;                           \
+    out[D1*stride].re = dc.re + (TXUSample)z0[3].re;                 \
+    out[D1*stride].im = dc.im + (TXUSample)z0[0].im;                 \
+    out[D2*stride].re = dc.re + (TXUSample)z0[2].re;                 \
+    out[D2*stride].im = dc.im + (TXUSample)z0[1].im;                 \
+    out[D3*stride].re = dc.re + (TXUSample)z0[1].re;                 \
+    out[D3*stride].im = dc.im + (TXUSample)z0[2].im;                 \
+    out[D4*stride].re = dc.re + (TXUSample)z0[0].re;                 \
+    out[D4*stride].im = dc.im + (TXUSample)z0[3].im;                 \
 }
 
 DECL_FFT5(fft5,     0,  1,  2,  3,  4)
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avutil/tx_template: Fix some signed integer overflows in DECL_FFT5()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 842 bytes --]

On Fri, Sep 15, 2023 at 03:11:46PM +0200, Michael Niedermayer wrote:
> Fixes: signed integer overflow: -1364715454 + -1468954671 cannot be represented in type 'int'
> Fixes: 62093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5538774254485504
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavutil/tx_template.c | 20 ++++++++++----------
>  1 file changed, 10 insertions(+), 10 deletions(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Let us carefully observe those good qualities wherein our enemies excel us
and endeavor to excel them, by avoiding what is faulty, and imitating what
is excellent in them. -- Plutarch

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/4] avcodec/osq: avoid using too large numbers for shifts and integers in update_residue_parameter()

[Michael Niedermayer]

The code should be changed to not use floats in the VLC parameters
This patch merely fixes undefined behavior

Fixes: 2.96539e+09 is outside the range of representable values of type 'int'
Fixes: Assertion n>=0 && n<=32 failed at libavcodec/get_bits.h:423
Fixes: 62241/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-4525761925873664

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/osq.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index e2a84657fb4..e7f11691d2e 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -152,11 +152,15 @@ static int update_residue_parameter(OSQChannel *cb)
 
     sum = cb->sum;
     x = sum / cb->count;
-    rice_k = av_ceil_log2(x);
+    rice_k = ceil(log2(x));
     if (rice_k >= 30) {
-        rice_k = floor(sum / 1.4426952 + 0.5);
-        if (rice_k < 1)
+        double f = floor(sum / 1.4426952 + 0.5);
+        if (f <= 1) {
             rice_k = 1;
+        } else if (f >= 31) {
+            rice_k = 31;
+        } else
+            rice_k = f;
     }
 
     return rice_k;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 4/4] avcodec/osq: avoid using too large numbers for shifts and integers in update_residue_parameter()

[Paul B Mahol]

On Fri, Sep 15, 2023 at 3:12 PM Michael Niedermayer <michael@niedermayer.cc>
wrote:

> The code should be changed to not use floats in the VLC parameters
> This patch merely fixes undefined behavior
>
> Fixes: 2.96539e+09 is outside the range of representable values of type
> 'int'
> Fixes: Assertion n>=0 && n<=32 failed at libavcodec/get_bits.h:423
> Fixes:
> 62241/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-4525761925873664
>


NAK

Breaks decoding.


>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/osq.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/osq.c b/libavcodec/osq.c
> index e2a84657fb4..e7f11691d2e 100644
> --- a/libavcodec/osq.c
> +++ b/libavcodec/osq.c
> @@ -152,11 +152,15 @@ static int update_residue_parameter(OSQChannel *cb)
>
>      sum = cb->sum;
>      x = sum / cb->count;
> -    rice_k = av_ceil_log2(x);
> +    rice_k = ceil(log2(x));
>      if (rice_k >= 30) {
> -        rice_k = floor(sum / 1.4426952 + 0.5);
> -        if (rice_k < 1)
> +        double f = floor(sum / 1.4426952 + 0.5);
> +        if (f <= 1) {
>              rice_k = 1;
> +        } else if (f >= 31) {
> +            rice_k = 31;
> +        } else
> +            rice_k = f;
>      }
>
>      return rice_k;
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 4/4] avcodec/osq: avoid using too large numbers for shifts and integers in update_residue_parameter()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1023 bytes --]

On Fri, Sep 15, 2023 at 03:54:19PM +0200, Paul B Mahol wrote:
> On Fri, Sep 15, 2023 at 3:12 PM Michael Niedermayer <michael@niedermayer.cc>
> wrote:
> 
> > The code should be changed to not use floats in the VLC parameters
> > This patch merely fixes undefined behavior
> >
> > Fixes: 2.96539e+09 is outside the range of representable values of type
> > 'int'
> > Fixes: Assertion n>=0 && n<=32 failed at libavcodec/get_bits.h:423
> > Fixes:
> > 62241/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-4525761925873664
> >
> 
> 
> NAK
> 
> Breaks decoding.

Please provide sample that works before and fails after this.

That said, it has to be pointed out that the current code in osq is
buggy in multiply ways. The use of floats for computing vlc parameters is
not portable (unless theres alot of luck).

thx


[....]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I have often repented speaking, but never of holding my tongue.
-- Xenocrates

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/4] avcodec/evc_ps: Check cpb_cnt_minus1 and propagate error

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 670 bytes --]

On Fri, Sep 15, 2023 at 03:11:44PM +0200, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: 60949/clusterfuzz-testcase-minimized-ffmpeg_dem_EVC_fuzzer-5959738853294080
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/evc_ps.c | 27 +++++++++++++++++++++------
>  1 file changed, 21 insertions(+), 6 deletions(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Republics decline into democracies and democracies degenerate into
despotisms. -- Aristotle

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".