[FFmpeg-devel] [PATCH 1/7] avdevice/pulse_audio_enc: Use av_rescale() to avoid integer overflow

[FFmpeg-devel] [PATCH 1/7] avdevice/pulse_audio_enc: Use av_rescale() to avoid integer overflow

[Michael Niedermayer]

Fixes: CID1503075 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavdevice/pulse_audio_enc.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/libavdevice/pulse_audio_enc.c b/libavdevice/pulse_audio_enc.c
index 3e2cc91f697..80136d1e20c 100644
--- a/libavdevice/pulse_audio_enc.c
+++ b/libavdevice/pulse_audio_enc.c
@@ -471,10 +471,11 @@ static av_cold int pulse_write_header(AVFormatContext *h)
     s->nonblocking = (h->flags & AVFMT_FLAG_NONBLOCK);
 
     if (s->buffer_duration) {
-        int64_t bytes = s->buffer_duration;
-        bytes *= st->codecpar->ch_layout.nb_channels * st->codecpar->sample_rate *
-                 av_get_bytes_per_sample(st->codecpar->format);
-        bytes /= 1000;
+        int64_t bytes = av_rescale(s->buffer_duration,
+                                   st->codecpar->ch_layout.nb_channels *
+                                    (int64_t)st->codecpar->sample_rate *
+                                    av_get_bytes_per_sample(st->codecpar->format),
+                                   1000);
         buffer_attributes.tlength = FFMAX(s->buffer_size, av_clip64(bytes, 0, UINT32_MAX - 1));
         av_log(s, AV_LOG_DEBUG,
                "Buffer duration: %ums recalculated into %"PRId64" bytes buffer.\n",
-- 
2.45.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/7] avformat/ac4dec: Check remaining space in ac4_probe()

[Michael Niedermayer]

Fixes: CID1538298 Untrusted loop bound
Fixes: undefined behavior

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/ac4dec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/ac4dec.c b/libavformat/ac4dec.c
index f647f557ccd..dc6638de3a4 100644
--- a/libavformat/ac4dec.c
+++ b/libavformat/ac4dec.c
@@ -43,6 +43,8 @@ static int ac4_probe(const AVProbeData *p)
             size += 4;
             if (buf[1] == 0x41)
                 size += 2;
+            if (left < size)
+                break;
             max_frames++;
             left -= size;
             buf += size;
-- 
2.45.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/7] avformat/ape: Use 64bit for final frame size

[Michael Niedermayer]

Fixes: CID1505963 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/ape.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/ape.c b/libavformat/ape.c
index c0e3e9f4fe6..f86ca5e894c 100644
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -292,7 +292,7 @@ static int ape_read_header(AVFormatContext * s)
         final_size -= final_size & 3;
     }
     if (file_size <= 0 || final_size <= 0)
-        final_size = ape->finalframeblocks * 8;
+        final_size = ape->finalframeblocks * 8LL;
     ape->frames[ape->totalframes - 1].size = final_size;
 
     for (i = 0; i < ape->totalframes; i++) {
-- 
2.45.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/7] avformat/argo_asf: Use 64bit in offset intermediate

[Michael Niedermayer]

Fixes: CID1467435 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/argo_asf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/argo_asf.c b/libavformat/argo_asf.c
index 61bfc6de1fc..e08f029f80c 100644
--- a/libavformat/argo_asf.c
+++ b/libavformat/argo_asf.c
@@ -259,7 +259,7 @@ static int argo_asf_seek(AVFormatContext *s, int stream_index,
         return -1;
 
     offset = asf->fhdr.chunk_offset + ASF_CHUNK_HEADER_SIZE +
-             (block * st->codecpar->block_align);
+             block * (int64_t)st->codecpar->block_align;
 
     if ((offset = avio_seek(s->pb, offset, SEEK_SET)) < 0)
         return offset;
-- 
2.45.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 5/7] avformat/asfdec_f: Use 64bit for preroll computation

[Michael Niedermayer]

Fixes: CID1500342 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/asfdec_f.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index fcc2b98a2c4..2441cadb444 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -675,7 +675,7 @@ static int asf_read_marker(AVFormatContext *s)
 
         avio_rl64(pb);             // offset, 8 bytes
         pres_time = avio_rl64(pb); // presentation time
-        pres_time = av_sat_sub64(pres_time, asf->hdr.preroll * 10000);
+        pres_time = av_sat_sub64(pres_time, asf->hdr.preroll * 10000LL);
         avio_rl16(pb);             // entry length
         avio_rl32(pb);             // send time
         avio_rl32(pb);             // flags
-- 
2.45.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 6/7] avcodec/sga: Make it clear that the return is intentionally not checked

[Michael Niedermayer]

Related: CID1473496 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/sga.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/sga.c b/libavcodec/sga.c
index 0f42cf912b2..618df000ada 100644
--- a/libavcodec/sga.c
+++ b/libavcodec/sga.c
@@ -73,7 +73,7 @@ static int decode_palette(GetByteContext *gb, uint32_t *pal)
         return AVERROR_INVALIDDATA;
 
     memset(pal, 0, 16 * sizeof(*pal));
-    init_get_bits8(&gbit, gb->buffer, 18);
+    (void)init_get_bits8(&gbit, gb->buffer, 18);
 
     for (int RGBIndex = 0; RGBIndex < 3; RGBIndex++) {
         for (int index = 0; index < 16; index++) {
-- 
2.45.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 7/7] avcodec/tests/bitstream_template: Make it clear that the return is intentionally not checked

[Michael Niedermayer]

Helps: CID1518967 Unchecked return value
Helps: CID1518968 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/tests/bitstream_template.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/tests/bitstream_template.c b/libavcodec/tests/bitstream_template.c
index ef59845154d..d8cf980bee1 100644
--- a/libavcodec/tests/bitstream_template.c
+++ b/libavcodec/tests/bitstream_template.c
@@ -74,7 +74,7 @@ int main(int argc, char **argv)
     for (unsigned i = 0; i < SIZE; i++)
         buf[i] = av_lfg_get(&lfg);
 
-    bits_init8   (&bc, buf, SIZE);
+    (void)bits_init8   (&bc, buf, SIZE);
     init_put_bits(&pb, dst, SIZE);
 
     /* use a random sequence of bitreading operations to transfer data
-- 
2.45.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 7/7] avcodec/tests/bitstream_template: Make it clear that the return is intentionally not checked

[Andreas Rheinhardt]

Michael Niedermayer:
> Helps: CID1518967 Unchecked return value
> Helps: CID1518968 Unchecked return value
> 
> Sponsored-by: Sovereign Tech Fund
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/tests/bitstream_template.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/tests/bitstream_template.c b/libavcodec/tests/bitstream_template.c
> index ef59845154d..d8cf980bee1 100644
> --- a/libavcodec/tests/bitstream_template.c
> +++ b/libavcodec/tests/bitstream_template.c
> @@ -74,7 +74,7 @@ int main(int argc, char **argv)
>      for (unsigned i = 0; i < SIZE; i++)
>          buf[i] = av_lfg_get(&lfg);
>  
> -    bits_init8   (&bc, buf, SIZE);
> +    (void)bits_init8   (&bc, buf, SIZE);
>      init_put_bits(&pb, dst, SIZE);
>  
>      /* use a random sequence of bitreading operations to transfer data

Test tools should actually test.

- Andreas

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 7/7] avcodec/tests/bitstream_template: Make it clear that the return is intentionally not checked

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1388 bytes --]

On Thu, May 23, 2024 at 10:22:56AM +0200, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > Helps: CID1518967 Unchecked return value
> > Helps: CID1518968 Unchecked return value
> > 
> > Sponsored-by: Sovereign Tech Fund
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/tests/bitstream_template.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/tests/bitstream_template.c b/libavcodec/tests/bitstream_template.c
> > index ef59845154d..d8cf980bee1 100644
> > --- a/libavcodec/tests/bitstream_template.c
> > +++ b/libavcodec/tests/bitstream_template.c
> > @@ -74,7 +74,7 @@ int main(int argc, char **argv)
> >      for (unsigned i = 0; i < SIZE; i++)
> >          buf[i] = av_lfg_get(&lfg);
> >  
> > -    bits_init8   (&bc, buf, SIZE);
> > +    (void)bits_init8   (&bc, buf, SIZE);
> >      init_put_bits(&pb, dst, SIZE);
> >  
> >      /* use a random sequence of bitreading operations to transfer data
> 
> Test tools should actually test.

will replace with a assert0() then

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Many that live deserve death. And some that die deserve life. Can you give
it to them? Then do not be too eager to deal out death in judgement. For
even the very wise cannot see all ends. -- Gandalf

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/7] avdevice/pulse_audio_enc: Use av_rescale() to avoid integer overflow

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 717 bytes --]

On Thu, May 23, 2024 at 03:17:52AM +0200, Michael Niedermayer wrote:
> Fixes: CID1503075 Unintentional integer overflow
> 
> Sponsored-by: Sovereign Tech Fund
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavdevice/pulse_audio_enc.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)

will apply remaining patches of patchset (1-6)

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

"You are 36 times more likely to die in a bathtub than at the hands of a
terrorist. Also, you are 2.5 times more likely to become a president and
2 times more likely to become an astronaut, than to die in a terrorist
attack." -- Thoughty2


[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".