From: mezhuevtp@ispras.ru
To: ffmpeg-devel@ffmpeg.org
Cc: mezhuevtp@ispras.ru, headshog <craaaaaachind@gmail.com>
Subject: [FFmpeg-devel] [PATCH] libavformat\svs.c: Fixed, not it is in the right place
Date: Mon, 25 Sep 2023 14:42:54 +0300
Message-ID: <20230925114254.4041393-1-mezhuevtp@ispras.ru> (raw)
From: headshog <craaaaaachind@gmail.com>
---
0001-Fixed-not-it-is-in-the-right-place.patch | 89 +++++++++++++++++++
0001-Numeric-truncation-in-svs.c-57.patch | 41 +++++++++
libavformat/svs.c | 7 +-
3 files changed, 136 insertions(+), 1 deletion(-)
create mode 100644 0001-Fixed-not-it-is-in-the-right-place.patch
create mode 100644 0001-Numeric-truncation-in-svs.c-57.patch
diff --git a/0001-Fixed-not-it-is-in-the-right-place.patch b/0001-Fixed-not-it-is-in-the-right-place.patch
new file mode 100644
index 0000000000..8373c56851
--- /dev/null
+++ b/0001-Fixed-not-it-is-in-the-right-place.patch
@@ -0,0 +1,89 @@
+From ea89215a6b5627f73c370381f07a87f1ccb146ea Mon Sep 17 00:00:00 2001
+From: headshog <craaaaaachind@gmail.com>
+Date: Mon, 25 Sep 2023 14:38:04 +0300
+Subject: [PATCH] Fixed, not it is in the right place.
+
+---
+ 0001-Numeric-truncation-in-svs.c-57.patch | 41 +++++++++++++++++++++++
+ libavformat/svs.c | 7 +++-
+ 2 files changed, 47 insertions(+), 1 deletion(-)
+ create mode 100644 0001-Numeric-truncation-in-svs.c-57.patch
+
+diff --git a/0001-Numeric-truncation-in-svs.c-57.patch b/0001-Numeric-truncation-in-svs.c-57.patch
+new file mode 100644
+index 0000000000..dbfdf07e6f
+--- /dev/null
++++ b/0001-Numeric-truncation-in-svs.c-57.patch
+@@ -0,0 +1,41 @@
++From a9b235e392024f1877d5c43fc0129e9eebb6aea2 Mon Sep 17 00:00:00 2001
++From: headshog <craaaaaachind@gmail.com>
++Date: Mon, 25 Sep 2023 12:48:22 +0300
++Subject: [PATCH] Numeric truncation in svs.c:57
++
++Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
++In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
++Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
++In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
++---
++ libavformat/svs.c | 7 ++++++-
++ 1 file changed, 6 insertions(+), 1 deletion(-)
++
++diff --git a/libavformat/svs.c b/libavformat/svs.c
++index b91d29f5a6..54f24f539c 100644
++--- a/libavformat/svs.c
+++++ b/libavformat/svs.c
++@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
++ {
++ AVStream *st;
++ uint32_t pitch;
+++ int64_t rescale_val;
+++
+++ rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+++ if (rescale_val > INT_MAX)
+++ return AVERROR(ERANGE);
++
++ st = avformat_new_stream(s, NULL);
++ if (!st)
++@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
++ st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
++ st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX;
++ st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
++- st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+++ st->codecpar->sample_rate = rescale_val;
++ st->codecpar->block_align = 32;
++ st->start_time = 0;
++ if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
++--
++2.25.1
++
+diff --git a/libavformat/svs.c b/libavformat/svs.c
+index b91d29f5a6..bdfb856184 100644
+--- a/libavformat/svs.c
++++ b/libavformat/svs.c
+@@ -42,6 +42,7 @@ static int svs_read_header(AVFormatContext *s)
+ {
+ AVStream *st;
+ uint32_t pitch;
++ int64_t rescale_val;
+
+ st = avformat_new_stream(s, NULL);
+ if (!st)
+@@ -51,10 +52,14 @@ static int svs_read_header(AVFormatContext *s)
+ pitch = avio_rl32(s->pb);
+ avio_skip(s->pb, 12);
+
++ rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++ if (rescale_val > INT_MAX)
++ return AVERROR(ERANGE);
++
+ st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
+ st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX;
+ st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
+- st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++ st->codecpar->sample_rate = rescale_val;
+ st->codecpar->block_align = 32;
+ st->start_time = 0;
+ if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
+--
+2.25.1
+
diff --git a/0001-Numeric-truncation-in-svs.c-57.patch b/0001-Numeric-truncation-in-svs.c-57.patch
new file mode 100644
index 0000000000..dbfdf07e6f
--- /dev/null
+++ b/0001-Numeric-truncation-in-svs.c-57.patch
@@ -0,0 +1,41 @@
+From a9b235e392024f1877d5c43fc0129e9eebb6aea2 Mon Sep 17 00:00:00 2001
+From: headshog <craaaaaachind@gmail.com>
+Date: Mon, 25 Sep 2023 12:48:22 +0300
+Subject: [PATCH] Numeric truncation in svs.c:57
+
+Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
+In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
+Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
+In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
+---
+ libavformat/svs.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/libavformat/svs.c b/libavformat/svs.c
+index b91d29f5a6..54f24f539c 100644
+--- a/libavformat/svs.c
++++ b/libavformat/svs.c
+@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
+ {
+ AVStream *st;
+ uint32_t pitch;
++ int64_t rescale_val;
++
++ rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++ if (rescale_val > INT_MAX)
++ return AVERROR(ERANGE);
+
+ st = avformat_new_stream(s, NULL);
+ if (!st)
+@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
+ st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
+ st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX;
+ st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
+- st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++ st->codecpar->sample_rate = rescale_val;
+ st->codecpar->block_align = 32;
+ st->start_time = 0;
+ if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
+--
+2.25.1
+
diff --git a/libavformat/svs.c b/libavformat/svs.c
index b91d29f5a6..bdfb856184 100644
--- a/libavformat/svs.c
+++ b/libavformat/svs.c
@@ -42,6 +42,7 @@ static int svs_read_header(AVFormatContext *s)
{
AVStream *st;
uint32_t pitch;
+ int64_t rescale_val;
st = avformat_new_stream(s, NULL);
if (!st)
@@ -51,10 +52,14 @@ static int svs_read_header(AVFormatContext *s)
pitch = avio_rl32(s->pb);
avio_skip(s->pb, 12);
+ rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+ if (rescale_val > INT_MAX)
+ return AVERROR(ERANGE);
+
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX;
st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
- st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+ st->codecpar->sample_rate = rescale_val;
st->codecpar->block_align = 32;
st->start_time = 0;
if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
--
2.25.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
reply other threads:[~2023-09-25 11:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230925114254.4041393-1-mezhuevtp@ispras.ru \
--to=mezhuevtp@ispras.ru \
--cc=craaaaaachind@gmail.com \
--cc=ffmpeg-devel@ffmpeg.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git