[FFmpeg-devel] [PATCH 1/5] tools/target_dec_fuzzer: Adjust wmapro threshold

[FFmpeg-devel] [PATCH 1/5] tools/target_dec_fuzzer: Adjust wmapro threshold

[Michael Niedermayer]

Fixes: Timeout
Fixes: 62266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5125460729921536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 tools/target_dec_fuzzer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index c3f88ef49f6..b26fcb4b416 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -308,6 +308,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     case AV_CODEC_ID_WMV3:        maxpixels  /= 1024;  break;
     case AV_CODEC_ID_WS_VQA:      maxpixels  /= 16384; break;
     case AV_CODEC_ID_WMALOSSLESS: maxsamples /= 1024;  break;
+    case AV_CODEC_ID_WMAPRO:      maxsamples /= 16384; break;
     case AV_CODEC_ID_YLC:         maxpixels  /= 1024;  break;
     case AV_CODEC_ID_ZEROCODEC:   maxpixels  /= 128;   break;
     case AV_CODEC_ID_ZLIB:        maxpixels  /= 4096;  break;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/5] avcodec/apedec: Fix an integer overflow in predictor_update_filter()

[Michael Niedermayer]

Fixes: signed integer overflow: -2147483506 + -801380 cannot be represented in type 'int'
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6578985923117056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/apedec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c
index 62cb397490d..8bfbb75b41e 100644
--- a/libavcodec/apedec.c
+++ b/libavcodec/apedec.c
@@ -1220,7 +1220,7 @@ static av_always_inline int predictor_update_filter(APEPredictor64 *p,
     if (interim_mode < 1) {
         predictionA = (int32_t)predictionA;
         predictionB = (int32_t)predictionB;
-        p->lastA[filter] = decoded + ((int32_t)(predictionA + (predictionB >> 1)) >> 10);
+        p->lastA[filter] = (int32_t)(decoded + (unsigned)((int32_t)(predictionA + (predictionB >> 1)) >> 10));
     } else {
         p->lastA[filter] = decoded + ((int64_t)((uint64_t)predictionA + (predictionB >> 1)) >> 10);
     }
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/5] avcodec/dcadec: Do not explode EAGAIN

[Michael Niedermayer]

Fixes: out of array access
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_fuzzer-6041088751960064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/dcadec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c
index 3e3e3053bbe..070a9ae094d 100644
--- a/libavcodec/dcadec.c
+++ b/libavcodec/dcadec.c
@@ -221,7 +221,7 @@ static int dcadec_decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     && (prev_packet & DCA_PACKET_XLL)
                     && (s->packet & DCA_PACKET_CORE))
                     s->packet |= DCA_PACKET_XLL | DCA_PACKET_RECOVERY;
-                else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE))
+                else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE) && ret != AVERROR(EAGAIN))
                     return ret;
             } else {
                 s->packet |= DCA_PACKET_XLL;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/5] avcodec/dcadec: Do not explode EAGAIN

[James Almer]

On 9/18/2023 7:35 PM, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_fuzzer-6041088751960064
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavcodec/dcadec.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c
> index 3e3e3053bbe..070a9ae094d 100644
> --- a/libavcodec/dcadec.c
> +++ b/libavcodec/dcadec.c
> @@ -221,7 +221,7 @@ static int dcadec_decode_frame(AVCodecContext *avctx, AVFrame *frame,
>                       && (prev_packet & DCA_PACKET_XLL)
>                       && (s->packet & DCA_PACKET_CORE))
>                       s->packet |= DCA_PACKET_XLL | DCA_PACKET_RECOVERY;
> -                else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE))
> +                else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE) && ret != AVERROR(EAGAIN))
>                       return ret;
>               } else {
>                   s->packet |= DCA_PACKET_XLL;

Maybe instead do

> diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c
> index 3e3e3053bb..3926115f21 100644
> --- a/libavcodec/dcadec.c
> +++ b/libavcodec/dcadec.c
> @@ -217,11 +217,10 @@ static int dcadec_decode_frame(AVCodecContext *avctx, AVFrame *frame,
>          if (asset && (asset->extension_mask & DCA_EXSS_XLL)) {
>              if ((ret = ff_dca_xll_parse(&s->xll, input, asset)) < 0) {
>                  // Conceal XLL synchronization error
> -                if (ret == AVERROR(EAGAIN)
> -                    && (prev_packet & DCA_PACKET_XLL)
> -                    && (s->packet & DCA_PACKET_CORE))
> -                    s->packet |= DCA_PACKET_XLL | DCA_PACKET_RECOVERY;
> -                else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE))
> +                if (ret == AVERROR(EAGAIN) {
> +                    if ((prev_packet & DCA_PACKET_XLL) && (s->packet & DCA_PACKET_CORE))
> +                        s->packet |= DCA_PACKET_XLL | DCA_PACKET_RECOVERY;
> +                } else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE))
>                      return ret;
>              } else {
>                  s->packet |= DCA_PACKET_XLL;

So EAGAIN is handled in one place.

LGTM either way.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/5] avcodec/dcadec: Do not explode EAGAIN

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 2891 bytes --]

On Mon, Sep 18, 2023 at 08:24:25PM -0300, James Almer wrote:
> On 9/18/2023 7:35 PM, Michael Niedermayer wrote:
> > Fixes: out of array access
> > Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_fuzzer-6041088751960064
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >   libavcodec/dcadec.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c
> > index 3e3e3053bbe..070a9ae094d 100644
> > --- a/libavcodec/dcadec.c
> > +++ b/libavcodec/dcadec.c
> > @@ -221,7 +221,7 @@ static int dcadec_decode_frame(AVCodecContext *avctx, AVFrame *frame,
> >                       && (prev_packet & DCA_PACKET_XLL)
> >                       && (s->packet & DCA_PACKET_CORE))
> >                       s->packet |= DCA_PACKET_XLL | DCA_PACKET_RECOVERY;
> > -                else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE))
> > +                else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE) && ret != AVERROR(EAGAIN))
> >                       return ret;
> >               } else {
> >                   s->packet |= DCA_PACKET_XLL;
> 
> Maybe instead do
> 
> > diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c
> > index 3e3e3053bb..3926115f21 100644
> > --- a/libavcodec/dcadec.c
> > +++ b/libavcodec/dcadec.c
> > @@ -217,11 +217,10 @@ static int dcadec_decode_frame(AVCodecContext *avctx, AVFrame *frame,
> >          if (asset && (asset->extension_mask & DCA_EXSS_XLL)) {
> >              if ((ret = ff_dca_xll_parse(&s->xll, input, asset)) < 0) {
> >                  // Conceal XLL synchronization error
> > -                if (ret == AVERROR(EAGAIN)
> > -                    && (prev_packet & DCA_PACKET_XLL)
> > -                    && (s->packet & DCA_PACKET_CORE))
> > -                    s->packet |= DCA_PACKET_XLL | DCA_PACKET_RECOVERY;
> > -                else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE))
> > +                if (ret == AVERROR(EAGAIN) {
> > +                    if ((prev_packet & DCA_PACKET_XLL) && (s->packet & DCA_PACKET_CORE))
> > +                        s->packet |= DCA_PACKET_XLL | DCA_PACKET_RECOVERY;
> > +                } else if (ret == AVERROR(ENOMEM) || (avctx->err_recognition & AV_EF_EXPLODE))
> >                      return ret;
> >              } else {
> >                  s->packet |= DCA_PACKET_XLL;
> 
> So EAGAIN is handled in one place.

ok will apply with you as author as its your change now

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Everything should be made as simple as possible, but not simpler.
-- Albert Einstein

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/5] avcodec/escape124: Do not return random numbers

[Michael Niedermayer]

Fixes: out of array access
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-6035022714634240
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-6422176201572352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/escape124.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/escape124.c b/libavcodec/escape124.c
index cd62f8d1f04..357320ef94f 100644
--- a/libavcodec/escape124.c
+++ b/libavcodec/escape124.c
@@ -234,7 +234,7 @@ static int escape124_decode_frame(AVCodecContext *avctx, AVFrame *frame,
         if ((ret = av_frame_ref(frame, s->frame)) < 0)
             return ret;
 
-        return frame_size;
+        return 0;
     }
 
     for (i = 0; i < 3; i++) {
@@ -367,7 +367,7 @@ static int escape124_decode_frame(AVCodecContext *avctx, AVFrame *frame,
 
     *got_frame = 1;
 
-    return frame_size;
+    return 0;
 }
 
 
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 5/5] avcodec/decode: EAGAIN is not fully supported in decode_simple_internal()

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/decode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/decode.c b/libavcodec/decode.c
index 169ee79acd9..376e4a4d373 100644
--- a/libavcodec/decode.c
+++ b/libavcodec/decode.c
@@ -457,6 +457,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
     if (ret == AVERROR(EAGAIN))
         av_frame_unref(frame);
 
+    av_assert0(consumed != AVERROR(EAGAIN)); // code later will add AVERROR(EAGAIN) to a pointer
     if (consumed < 0)
         ret = consumed;
     if (consumed >= 0 && avctx->codec->type == AVMEDIA_TYPE_VIDEO)
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 5/5] avcodec/decode: EAGAIN is not fully supported in decode_simple_internal()

[James Almer]

On 9/18/2023 7:35 PM, Michael Niedermayer wrote:
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavcodec/decode.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/libavcodec/decode.c b/libavcodec/decode.c
> index 169ee79acd9..376e4a4d373 100644
> --- a/libavcodec/decode.c
> +++ b/libavcodec/decode.c
> @@ -457,6 +457,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
>       if (ret == AVERROR(EAGAIN))
>           av_frame_unref(frame);
>   
> +    av_assert0(consumed != AVERROR(EAGAIN)); // code later will add AVERROR(EAGAIN) to a pointer

FF_CODEC_CB_TYPE_DECODE decoders must not return EAGAIN or EOF, only 
actual error codes. IMO that should be stated too.

>       if (consumed < 0)
>           ret = consumed;
>       if (consumed >= 0 && avctx->codec->type == AVMEDIA_TYPE_VIDEO)

LGTM.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 5/5] avcodec/decode: EAGAIN is not fully supported in decode_simple_internal()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1236 bytes --]

On Mon, Sep 18, 2023 at 08:30:58PM -0300, James Almer wrote:
> On 9/18/2023 7:35 PM, Michael Niedermayer wrote:
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >   libavcodec/decode.c | 1 +
> >   1 file changed, 1 insertion(+)
> > 
> > diff --git a/libavcodec/decode.c b/libavcodec/decode.c
> > index 169ee79acd9..376e4a4d373 100644
> > --- a/libavcodec/decode.c
> > +++ b/libavcodec/decode.c
> > @@ -457,6 +457,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
> >       if (ret == AVERROR(EAGAIN))
> >           av_frame_unref(frame);
> > +    av_assert0(consumed != AVERROR(EAGAIN)); // code later will add AVERROR(EAGAIN) to a pointer
> 
> FF_CODEC_CB_TYPE_DECODE decoders must not return EAGAIN or EOF, only actual
> error codes. IMO that should be stated too.

ok will apply with an expanded comment


> 
> >       if (consumed < 0)
> >           ret = consumed;
> >       if (consumed >= 0 && avctx->codec->type == AVMEDIA_TYPE_VIDEO)
> 
> LGTM.

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Complexity theory is the science of finding the exact solution to an
approximation. Benchmarking OTOH is finding an approximation of the exact

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/5] tools/target_dec_fuzzer: Adjust wmapro threshold

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 738 bytes --]

On Tue, Sep 19, 2023 at 12:35:30AM +0200, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 62266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5125460729921536
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  tools/target_dec_fuzzer.c | 1 +
>  1 file changed, 1 insertion(+)

will apply the remaining patches that had no comments, from this set

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Dictatorship naturally arises out of democracy, and the most aggravated
form of tyranny and slavery out of the most extreme liberty. -- Plato

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".