From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 2961447A04 for ; Sat, 27 Jan 2024 23:57:08 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id AABDD68D0C9; Sun, 28 Jan 2024 01:57:04 +0200 (EET) Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [217.70.183.197]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 805AF68C9E0 for ; Sun, 28 Jan 2024 01:56:57 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id 871C11C0002 for ; Sat, 27 Jan 2024 23:56:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1706399816; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Xm4pAas2d0scQOtYtDWKwHY3Y+SoRJ20OhjKdbdDOc0=; b=PQYofudz2Zn5/mFzYi3Xa4GrImn7vLgj2EAFR/j6HS3+AWVp75u4XNqmrZq5kZv43Q3ryj CVfrVewdQhJwGQJhZwRltmNzFXk6hQuMp/e2rLOfu/C1ck+zPsNLFU+oil/jPEfA0lynrP x2+hH4i/7RinIRT3rEQ1ybDO9AdlFcD38v8dn4v9gTWZJ9DPsXuw2pixCJuZYovTNUXKoA xfJ95SkEdJXx4/kVbSxeyHiL9WdWk9fa71CadNJeVmI7tDTS6bG36Uob1t8TcqZkIl0prJ vFSmP0SRsFt62qzjlXKbeAzaeWBaY+oKlSh4gkEbeFgGAHmEFPHh9Zw+8RuQ8g== Date: Sun, 28 Jan 2024 00:56:55 +0100 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20240127235655.GL6420@pb2> References: <20240126214651.22783-1-michael@niedermayer.cc> <20240126214651.22783-2-michael@niedermayer.cc> <3c7036cc-6c11-435c-bd98-084d253ac4c3@gmail.com> MIME-Version: 1.0 In-Reply-To: <3c7036cc-6c11-435c-bd98-084d253ac4c3@gmail.com> X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH 2/3] avcodec/cbs_h266_syntax_template: sanity check num_multi_layer_olss X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============5734912932867997031==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============5734912932867997031== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="z0Sj6johTOAdYsR7" Content-Disposition: inline --z0Sj6johTOAdYsR7 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Jan 27, 2024 at 09:25:16AM -0300, James Almer wrote: > On 1/26/2024 6:46 PM, Michael Niedermayer wrote: > > It is not possible to encode a index into an empty list. Thus > > this must be invalid at this point or before. > > Its likely a broader earlier check can be used here, someone knowing > > VVC should look at that. Its not immedeatly obvious from the spec > > by looking for numlayerolss >=20 > Can you check if the following fixes it? >=20 > > diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h26= 6_syntax_template.c > > index 549d021211..40572dadb5 100644 > > --- a/libavcodec/cbs_h266_syntax_template.c > > +++ b/libavcodec/cbs_h266_syntax_template.c > > @@ -793,6 +793,7 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, R= WContext *rw, > > { > > //calc NumMultiLayerOlss > > int m; > > + int num_layers_in_ols =3D 0; > > uint8_t dependency_flag[VVC_MAX_LAYERS][VVC_MAX_LAYERS]; > > uint16_t num_output_layers_in_ols[VVC_MAX_TOTAL_NUM_OLSS]; > > uint8_t num_sub_layers_in_layer_in_ols[VVC_MAX_TOTAL_NUM_OLSS]= [VVC_MAX_TOTAL_NUM_OLSS]; > > @@ -895,7 +896,6 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, R= WContext *rw, > > return AVERROR_INVALIDDATA; > > } > > for (i =3D 1; i < total_num_olss; i++) { > > - int num_layers_in_ols =3D 0; > > if (current->vps_each_layer_is_an_ols_flag) { > > num_layers_in_ols =3D 1; > > } else if (current->vps_ols_mode_idc =3D=3D 0 || >=20 > num_layers_in_ols is not meant to be reset on every loop. replacing my patch by yours does not change num_multi_layer_olss from being 0 and if its 0 then "num_multi_layer_olss - 1" causes problems as a limit more precissely this: i can also send you the file if you want? tools/target_bsf_vvc_metadata_fuzzer: Running 1 inputs 1 time(s) each. Running: /home/michael/libfuzz-repro/65160/clusterfuzz-testcase-minimized-f= fmpeg_BSF_VVC_METADATA_fuzzer-4665241535119360 libavcodec/cbs_h266_syntax_template.c:1001:21: runtime error: index 257 out= of bounds for type 'uint8_t [257]' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/cbs_h266= _syntax_template.c:1001:21 in libavcodec/cbs_h266_syntax_template.c:1004:38: runtime error: index 257 out= of bounds for type 'uint8_t [257]' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/cbs_h266= _syntax_template.c:1004:38 in =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D29823=3D=3DERROR: AddressSanitizer: heap-buffer-overflow on address 0= x7ff104e7ca18 at pc 0x0000006a4fdb bp 0x7fffd376e7f0 sp 0x7fffd376e7e8 WRITE of size 1 at 0x7ff104e7ca18 thread T0 #0 0x6a4fda in cbs_h266_read_vps libavcodec/cbs_h266_syntax_template.c:= 1001:21 #1 0x5c87bc in cbs_h266_read_nal_unit libavcodec/cbs_h2645.c:1071:19 #2 0x4ff3aa in cbs_read_fragment_content libavcodec/cbs.c:215:15 #3 0x4ff3aa in cbs_read_data libavcodec/cbs.c:282 #4 0x5a53ea in ff_cbs_bsf_generic_filter libavcodec/cbs_bsf.c:75:11 #5 0x4c9b48 in LLVMFuzzerTestOneInput tools/target_bsf_fuzzer.c:154:16 #6 0x138eb7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, u= nsigned long) Fuzzer/build/../FuzzerLoop.cpp:495:13 #7 0x1383752 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsign= ed long) Fuzzer/build/../FuzzerDriver.cpp:273:6 #8 0x1388951 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned ch= ar const*, unsigned long)) Fuzzer/build/../FuzzerDriver.cpp:690:9 #9 0x1383430 in main Fuzzer/build/../FuzzerMain.cpp:20:10 #10 0x7ff10889ac86 in __libc_start_main /build/glibc-WcQU6j/glibc-2.27/= csu/../csu/libc-start.c:310 #11 0x41f429 in _start (tools/target_bsf_vvc_metadata_fuzzer+0x41f429) 0x7ff104e7ca18 is located 0 bytes to the right of 393752-byte region [0x7ff= 104e1c800,0x7ff104e7ca18) allocated by thread T0 here: #0 0x497e47 in posix_memalign /b/swarming/w/ir/cache/builder/src/third_= party/llvm/compiler-rt/lib/asan/asan_malloc_linux.cc:226:3 #1 0x130d3a8 in av_malloc libavutil/mem.c:105:9 #2 0x8fe1c5 in ff_refstruct_alloc_ext_c libavcodec/refstruct.c:109:11 #3 0x50c2bb in ff_cbs_alloc_unit_content libavcodec/cbs.c:933:25 #4 0x5c864f in cbs_h266_read_nal_unit libavcodec/cbs_h2645.c:1046:11 #5 0x4ff3aa in cbs_read_fragment_content libavcodec/cbs.c:215:15 #6 0x4ff3aa in cbs_read_data libavcodec/cbs.c:282 #7 0x5a53ea in ff_cbs_bsf_generic_filter libavcodec/cbs_bsf.c:75:11 #8 0x4c9b48 in LLVMFuzzerTestOneInput tools/target_bsf_fuzzer.c:154:16 #9 0x138eb7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, u= nsigned long) Fuzzer/build/../FuzzerLoop.cpp:495:13 #10 0x1383752 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsig= ned long) Fuzzer/build/../FuzzerDriver.cpp:273:6 #11 0x1388951 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned c= har const*, unsigned long)) Fuzzer/build/../FuzzerDriver.cpp:690:9 #12 0x1383430 in main Fuzzer/build/../FuzzerMain.cpp:20:10 #13 0x7ff10889ac86 in __libc_start_main /build/glibc-WcQU6j/glibc-2.27/= csu/../csu/libc-start.c:310 [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Those who are best at talking, realize last or never when they are wrong. --z0Sj6johTOAdYsR7 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZbWYOwAKCRBhHseHBAsP q+kTAJ4pLt1Dx4U/EB7s2o+fHAvBlbxV0QCfSA8rdtm+AQFSUEj3TI8/Tu4UFsk= =LbRU -----END PGP SIGNATURE----- --z0Sj6johTOAdYsR7-- --===============5734912932867997031== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============5734912932867997031==--