[FFmpeg-devel] [PATCH 1/5] avcodec/bonk: Fix undefined overflow in predictor_calc_error()

[FFmpeg-devel] [PATCH 1/5] avcodec/bonk: Fix undefined overflow in predictor_calc_error()

[Michael Niedermayer]

Fixes: signed integer overflow: -2146469728 - 1488954 cannot be represented in type 'int'
Fixes: 62490/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5612782399389696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/bonk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c
index 6cd6a0af619..65679e5fb65 100644
--- a/libavcodec/bonk.c
+++ b/libavcodec/bonk.c
@@ -270,7 +270,7 @@ static inline int shift(int a, int b)
 
 static int predictor_calc_error(int *k, int *state, int order, int error)
 {
-    int i, x = error - shift_down(k[order-1] * (unsigned)state[order-1], LATTICE_SHIFT);
+    int i, x = error - (unsigned)shift_down(k[order-1] * (unsigned)state[order-1], LATTICE_SHIFT);
     int *k_ptr = &(k[order-2]),
         *state_ptr = &(state[order-2]);
 
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/5] avformat/usmdec: do not return 0 when no packet was produced

[Michael Niedermayer]

Fixes: Assertion pkt->stream_index < (unsigned)s->nb_streams && "Invalid stream index.\n" failed at libavformat/demux.c:617
Fixes: 62498/clusterfuzz-testcase-minimized-ffmpeg_dem_USM_fuzzer-4734740995112960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/usmdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/usmdec.c b/libavformat/usmdec.c
index 1665eb8e551..b0079a1230c 100644
--- a/libavformat/usmdec.c
+++ b/libavformat/usmdec.c
@@ -361,7 +361,7 @@ static int64_t parse_chunk(AVFormatContext *s, AVIOContext *pb,
     ret = avio_skip(pb, FFMAX(0, chunk_size - (ret - chunk_start)));
     if (ret < 0)
         return ret;
-    return 0;
+    return AVERROR(EAGAIN);
 }
 
 static int usm_read_packet(AVFormatContext *s, AVPacket *pkt)
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/5] avformat/usmdec: do not return 0 when no packet was produced

[Anton Khirnov]

Quoting Michael Niedermayer (2023-10-05 21:44:37)
> Fixes: Assertion pkt->stream_index < (unsigned)s->nb_streams && "Invalid stream index.\n" failed at libavformat/demux.c:617
> Fixes: 62498/clusterfuzz-testcase-minimized-ffmpeg_dem_USM_fuzzer-4734740995112960
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/usmdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/usmdec.c b/libavformat/usmdec.c
> index 1665eb8e551..b0079a1230c 100644
> --- a/libavformat/usmdec.c
> +++ b/libavformat/usmdec.c
> @@ -361,7 +361,7 @@ static int64_t parse_chunk(AVFormatContext *s, AVIOContext *pb,
>      ret = avio_skip(pb, FFMAX(0, chunk_size - (ret - chunk_start)));
>      if (ret < 0)
>          return ret;
> -    return 0;
> +    return AVERROR(EAGAIN);

I believe that should be FFERROR_REDO instead.

-- 
Anton Khirnov
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/5] avformat/usmdec: do not return 0 when no packet was produced

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1410 bytes --]

On Tue, Oct 10, 2023 at 01:24:23PM +0200, Anton Khirnov wrote:
> Quoting Michael Niedermayer (2023-10-05 21:44:37)
> > Fixes: Assertion pkt->stream_index < (unsigned)s->nb_streams && "Invalid stream index.\n" failed at libavformat/demux.c:617
> > Fixes: 62498/clusterfuzz-testcase-minimized-ffmpeg_dem_USM_fuzzer-4734740995112960
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/usmdec.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/usmdec.c b/libavformat/usmdec.c
> > index 1665eb8e551..b0079a1230c 100644
> > --- a/libavformat/usmdec.c
> > +++ b/libavformat/usmdec.c
> > @@ -361,7 +361,7 @@ static int64_t parse_chunk(AVFormatContext *s, AVIOContext *pb,
> >      ret = avio_skip(pb, FFMAX(0, chunk_size - (ret - chunk_start)));
> >      if (ret < 0)
> >          return ret;
> > -    return 0;
> > +    return AVERROR(EAGAIN);
> 
> I believe that should be FFERROR_REDO instead.

will use FFERROR_REDO instead.
will also apply the rest of the patch

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Does the universe only have a finite lifespan? No, its going to go on
forever, its just that you wont like living in it. -- Hiranya Peiri

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/5] avcodec/cbs_h2645: Fix showing bits at the end in cbs_read_ue_golomb()

[Michael Niedermayer]

Fixes: Assertion n>0 && n<=25 failed at libavcodec/get_bits.h:375
Fixes: 62617/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5156555663998976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/cbs_h2645.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
index 0a1c8ea4266..fbfd671efea 100644
--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -43,7 +43,7 @@ static int cbs_read_ue_golomb(CodedBitstreamContext *ctx, GetBitContext *gbc,
 
     max_length = FFMIN(get_bits_left(gbc), 32);
 
-    leading_bits = show_bits_long(gbc, max_length);
+    leading_bits = max_length ? show_bits_long(gbc, max_length) : 0;
     if (leading_bits == 0) {
         if (max_length >= 32) {
             av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid ue-golomb code at "
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/5] avcodec/cbs_h2645: Fix showing bits at the end in cbs_read_se_golomb()

[Michael Niedermayer]

Fixes: Assertion n>0 && n<=25 failed at libavcodec/get_bits.h:375
Fixes: 62618/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5145745046765568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/cbs_h2645.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
index fbfd671efea..a7b9f3cef33 100644
--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -93,7 +93,7 @@ static int cbs_read_se_golomb(CodedBitstreamContext *ctx, GetBitContext *gbc,
 
     max_length = FFMIN(get_bits_left(gbc), 32);
 
-    leading_bits = show_bits_long(gbc, max_length);
+    leading_bits = max_length ? show_bits_long(gbc, max_length) : 0;
     if (leading_bits == 0) {
         if (max_length >= 32) {
             av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid se-golomb code at "
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 5/5] avcodec/xvididct: Make c* unsigned to avoid undefined overflows

[Michael Niedermayer]

Fixes: signed integer overflow: 1496950099 + 728014168 cannot be represented in type 'int'
Fixes: 62667/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-6511785170305024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/xvididct.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/libavcodec/xvididct.c b/libavcodec/xvididct.c
index dcea32210a2..01072d80ab7 100644
--- a/libavcodec/xvididct.c
+++ b/libavcodec/xvididct.c
@@ -56,13 +56,13 @@ static const int TAB35[] = { 26722, 25172, 22654, 19266, 15137, 10426, 5315 };
 
 static int idct_row(short *in, const int *const tab, int rnd)
 {
-    const int c1 = tab[0];
-    const int c2 = tab[1];
-    const int c3 = tab[2];
-    const int c4 = tab[3];
-    const int c5 = tab[4];
-    const int c6 = tab[5];
-    const int c7 = tab[6];
+    const unsigned c1 = tab[0];
+    const unsigned c2 = tab[1];
+    const unsigned c3 = tab[2];
+    const unsigned c4 = tab[3];
+    const unsigned c5 = tab[4];
+    const unsigned c6 = tab[5];
+    const unsigned c7 = tab[6];
 
     const int right = in[5] | in[6] | in[7];
     const int left  = in[1] | in[2] | in[3];
@@ -102,8 +102,8 @@ static int idct_row(short *in, const int *const tab, int rnd)
                 return 0;
         }
     } else if (!(left | right)) {
-        const int a0 = (rnd + c4 * (in[0] + in[4])) >> ROW_SHIFT;
-        const int a1 = (rnd + c4 * (in[0] - in[4])) >> ROW_SHIFT;
+        const int a0 = (int)(rnd + c4 * (in[0] + in[4])) >> ROW_SHIFT;
+        const int a1 = (int)(rnd + c4 * (in[0] - in[4])) >> ROW_SHIFT;
 
         in[0] = a0;
         in[3] = a0;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".