[FFmpeg-devel] [PATCH 1/2] avcodec/vvc/vvcdec: allow vvc_decode_close() on failed open

[FFmpeg-devel] [PATCH 1/2] avcodec/vvc/vvcdec: allow vvc_decode_close() on failed open

[Michael Niedermayer]

Fixes: division by 0
Fixes: 67008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5873503163187200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/vvc/vvcdec.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/libavcodec/vvc/vvcdec.c b/libavcodec/vvc/vvcdec.c
index f024cbd067..570e2aa513 100644
--- a/libavcodec/vvc/vvcdec.c
+++ b/libavcodec/vvc/vvcdec.c
@@ -950,13 +950,14 @@ static av_cold void vvc_decode_flush(AVCodecContext *avctx)
 {
     VVCContext *s  = avctx->priv_data;
     int got_output = 0;
-    VVCFrameContext *last;
 
     while (s->nb_delayed)
         wait_delayed_frame(s, NULL, &got_output);
 
-    last = get_frame_context(s, s->fcs, s->nb_frames - 1);
-    ff_vvc_flush_dpb(last);
+    if (s->fcs) {
+        VVCFrameContext *last = get_frame_context(s, s->fcs, s->nb_frames - 1);
+        ff_vvc_flush_dpb(last);
+    }
 
     s->eos = 1;
 }
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avcodec/vorbisdec: Check remaining data in vorbis_residue_decode_internal()

[Michael Niedermayer]

Fixes: timeout
Fixes: 66326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-6295291863040000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/vorbisdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index faeaeadde7..bf26b13b83 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -1468,6 +1468,9 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
                             unsigned step = FASTDIV(vr->partition_size << 1, dim << 1);
                             vorbis_codebook codebook = vc->codebooks[vqbook];
 
+                            if (get_bits_left(gb) <= 0)
+                                return AVERROR_INVALIDDATA;
+
                             if (vr_type == 0) {
 
                                 voffs = voffset+j*vlen;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/vvc/vvcdec: allow vvc_decode_close() on failed open

[Nuo Mi]

Pushed the VVC patch.
Thank you, Michael.

On Wed, Feb 28, 2024 at 6:47 AM Michael Niedermayer <michael@niedermayer.cc>
wrote:

> Fixes: division by 0
> Fixes:
> 67008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5873503163187200
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/vvc/vvcdec.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/vvc/vvcdec.c b/libavcodec/vvc/vvcdec.c
> index f024cbd067..570e2aa513 100644
> --- a/libavcodec/vvc/vvcdec.c
> +++ b/libavcodec/vvc/vvcdec.c
> @@ -950,13 +950,14 @@ static av_cold void vvc_decode_flush(AVCodecContext
> *avctx)
>  {
>      VVCContext *s  = avctx->priv_data;
>      int got_output = 0;
> -    VVCFrameContext *last;
>
>      while (s->nb_delayed)
>          wait_delayed_frame(s, NULL, &got_output);
>
> -    last = get_frame_context(s, s->fcs, s->nb_frames - 1);
> -    ff_vvc_flush_dpb(last);
> +    if (s->fcs) {
> +        VVCFrameContext *last = get_frame_context(s, s->fcs, s->nb_frames
> - 1);
> +        ff_vvc_flush_dpb(last);
> +    }
>
>      s->eos = 1;
>  }
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/vorbisdec: Check remaining data in vorbis_residue_decode_internal()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 659 bytes --]

On Tue, Feb 27, 2024 at 11:47:08PM +0100, Michael Niedermayer wrote:
> Fixes: timeout
> Fixes: 66326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-6295291863040000
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/vorbisdec.c | 3 +++
>  1 file changed, 3 insertions(+)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Good people do not need laws to tell them to act responsibly, while bad
people will find a way around the laws. -- Plato

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".