From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id D37314B9BC for ; Tue, 2 Jul 2024 22:28:06 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 3E92068D94E; Wed, 3 Jul 2024 01:28:03 +0300 (EEST) Received: from relay7-d.mail.gandi.net (relay7-d.mail.gandi.net [217.70.183.200]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 10F4D68D0CA for ; Wed, 3 Jul 2024 01:27:56 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 65DF320004 for ; Tue, 2 Jul 2024 22:27:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1719959275; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=QRBKkzac/2xIAjiIrCunAnKSSB+jkyKBCjuGOU4iErc=; b=jSIzkMIj+/Ty/mBvLfx1hW2fcOQXsJwJrQ4aMEDN5zGH4a/2e6P8JvX6YXW9P+A/rFLo6x Sh6KfAOg6SwdxWHOSbGRSXZ0zZzecgH+oAKGep7WfVODz/3/3SlsQehsoXw8ZvC0obIByj hqxT6ECqWbow3rpetiEl+IeM9Nxa0OZl1UMb3iSNEdHfUYWSQ7GfhoJDo5lEH1dLz00y6s 91+6u1MFa+rh/eizpQcCk4XQzHedQ+h0SvtyIuqHRmrVuEbXwve4eGw9QYc4iYJXBMiLW9 KQjEFqk92b0riTPUxu1gVbBpggB0atLJbOFvg1fAuUpXj1dpYjxaIoyrpLnGlQ== Date: Wed, 3 Jul 2024 00:27:54 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20240702222754.GB4991@pb2> References: <20240701133923.GF4991@pb2> MIME-Version: 1.0 In-Reply-To: <20240701133923.GF4991@pb2> X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [RFC] av_rescale() coverity X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============4191650347115422433==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============4191650347115422433== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="vt4ed5MNefdcgji4" Content-Disposition: inline --vt4ed5MNefdcgji4 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jul 01, 2024 at 03:39:23PM +0200, Michael Niedermayer wrote: latest coverity fun: CID 1604534: (#1 of 1): Overflowed constant (INTEGER_OVERFLOW) overflow_const: Expression gain, which is equal to 4294967295, where get_bi= ts1(gb) ? get_bits(gb, 4) - 7U : 4294967295U is known to be equal to 429496= 7295, overflows the type that receives it, a signed integer 32 bits wide. 371 int gain =3D get_bits1(gb) ? get_bits(gb, 4) - 7 : -1; In case you dont see it: storing -1 in an int is a overflow (yes i see its unsigned intermediate but that doesnt matter, thats normal c= ode and perfectly well defined) and another one: CID 1604357: (#1 of 1): Overflowed constant (INTEGER_OVERFLOW) overflow_const: Expression state << 8, which is equal to 17179869184, where= state is known to be equal to 72057594105036800, overflows the type that r= eceives it, an unsigned integer 64 bits wide. 61 state =3D (state << 8) | buf[i]; Just to clarify this, there is NOTHING else here, nothing explains why cove= rity "thinks" this has value 72057594105036800 before of course either way this doesnt matter and is perfectly fine code More fun: 5. known_value_assign: chunk_type =3D bytestream2_get_le32(&gb), its = value is now 0. 361 chunk_type =3D bytestream2_get_le32(&gb); 6. Condition !chunk_type, taking false branch. 362 if (!chunk_type) 363 break; do you spot the brilliant logic ? 6. known_value_assign: segments =3D segments, its value is now 4294967295. CID 1604539: (#1 of 1): Overflowed constant (INTEGER_OVERFLOW) 7. overflow_const: Expression segments--, which is equal to 4294967295, whe= re segments is known to be equal to 0, underflows the type that receives it= , an unsigned integer 32 bits wide. 82 while (segments--) { my god the loop reached 0, can you imagine coverity reallly is cracking down on unsigned heres another: 4. function_return: Function bytestream2_get_byte(gbc) returns 0. CID 1604484: (#1 of 1): Overflowed constant (INTEGER_OVERFLOW) 5. overflow_const: Expression version_major, which is equal to 4294967295, = where bytestream2_get_byte(gbc) - 1U is known to be equal to 4294967295, ov= erflows the type that receives it, a signed integer 32 bits wide. version_major =3D bytestream2_get_byte(gbc) - 1; ohh my god storing -1 in a signed integer these new issues are almost hillarious and entertaining, if they wouldnt cost time to investigate each and close thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Breaking DRM is a little like attempting to break through a door even though the window is wide open and the only thing in the house is a bunch of things you dont want and which you would get tomorrow for free anyway --vt4ed5MNefdcgji4 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZoR+5gAKCRBhHseHBAsP qwyBAKCGaN2Lbt6jHTgCoVrutgdcH74XxwCfSBTH25HZXsRED54wYN98cw2s5A0= =QOty -----END PGP SIGNATURE----- --vt4ed5MNefdcgji4-- --===============4191650347115422433== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============4191650347115422433==--