From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id B36CC4580C for ; Fri, 22 Sep 2023 16:47:58 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 13A6668C9AD; Fri, 22 Sep 2023 19:47:56 +0300 (EEST) Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [217.70.183.197]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 7D72D68C96F for ; Fri, 22 Sep 2023 19:47:50 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 8A81E1C0002 for ; Fri, 22 Sep 2023 16:47:49 +0000 (UTC) Date: Fri, 22 Sep 2023 18:47:48 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20230922164748.GY8640@pb2> References: <20230921180912.10733-1-michael@niedermayer.cc> MIME-Version: 1.0 In-Reply-To: X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH 1/6] avcodec/osq: Check that pkt_offset does not exceed pkt size X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============8443369809130929366==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============8443369809130929366== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="w47z9evyjOavafUr" Content-Disposition: inline --w47z9evyjOavafUr Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Sep 21, 2023 at 08:14:31PM +0200, Paul B Mahol wrote: > On Thu, Sep 21, 2023 at 8:09=E2=80=AFPM Michael Niedermayer > wrote: >=20 > > Fixes: out of array access > > Fixes: > > 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6227= 491892887552 > > Fixes: > > 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6268= 561729126400 > > Fixes: > > 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6414= 805046788096 > > Fixes: > > 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6538= 151088488448 > > Fixes: > > 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6608= 131540779008 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by > > : > > Michael Niedermayer > > --- > > libavcodec/osq.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/libavcodec/osq.c b/libavcodec/osq.c > > index e7f11691d2e..bcc75fef6fc 100644 > > --- a/libavcodec/osq.c > > +++ b/libavcodec/osq.c > > @@ -408,6 +408,9 @@ static int osq_receive_frame(AVCodecContext *avctx, > > AVFrame *frame) > > GetBitContext *gb =3D &s->gb; > > int ret, n; > > > > + if (s->pkt_offset > s->pkt->size) > > + s->pkt_offset =3D 0; > > >=20 > This is more hack than real fix. why ? pkt->size is reset outside the codec, so either it needs to be checked on codec entry or the codec should not use internal->in_pkt and expect its size to be conserved or implement flush() or something ff_decode_flush_buffers() for example will clear teh packet if you prefer i can implement flush() and reset pkt_offset in it that probably would achieve teh same just say if you prefer that ? thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB When the tyrant has disposed of foreign enemies by conquest or treaty, and there is nothing more to fear from them, then he is always stirring up some war or other, in order that the people may require a leader. -- Plato --w47z9evyjOavafUr Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iFwEABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZQ3FMQAKCRBhHseHBAsP q5ESAJjcyIbRkget+kjmlVAqAsGOPtaKAJ9ZTtYiaXhL0DP0aw9AkYiZPkaQpw== =EHqb -----END PGP SIGNATURE----- --w47z9evyjOavafUr-- --===============8443369809130929366== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============8443369809130929366==--