[FFmpeg-devel] [PATCH 1/8] avfilter/vf_elbg: Use unsigned for shifting into the top bit

[FFmpeg-devel] [PATCH 1/8] avfilter/vf_elbg: Use unsigned for shifting into the top bit

[Michael Niedermayer]

Fixes: part of CID1355110 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_elbg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/vf_elbg.c b/libavfilter/vf_elbg.c
index 732a2c8abfb..dd22da07b6b 100644
--- a/libavfilter/vf_elbg.c
+++ b/libavfilter/vf_elbg.c
@@ -195,7 +195,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
         p0 = (uint8_t *)out->data[0];
 
         for (i = 0; i < elbg->codebook_length; i++) {
-            const int al =  elbg->use_alpha ? elbg->codebook[i*4+3] : 0xff;
+            const unsigned al =  elbg->use_alpha ? elbg->codebook[i*4+3] : 0xff;
             pal[i] =  al                    << 24  |
                      (elbg->codebook[i*4+2] << 16) |
                      (elbg->codebook[i*4+1] <<  8) |
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/8] avfilter/vf_fftfilt: Remove dead depth code

[Michael Niedermayer]

Fixes: CID1509373 Logically dead code

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_fftfilt.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/libavfilter/vf_fftfilt.c b/libavfilter/vf_fftfilt.c
index 1ffbe02ec41..af0e1f51d24 100644
--- a/libavfilter/vf_fftfilt.c
+++ b/libavfilter/vf_fftfilt.c
@@ -382,11 +382,9 @@ static int config_props(AVFilterLink *inlink)
     if (s->depth <= 8) {
         s->rdft_horizontal = rdft_horizontal8;
         s->irdft_horizontal = irdft_horizontal8;
-    } else if (s->depth > 8) {
+    } else {
         s->rdft_horizontal = rdft_horizontal16;
         s->irdft_horizontal = irdft_horizontal16;
-    } else {
-        return AVERROR_BUG;
     }
     return 0;
 }
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/8] avfilter/vf_lut3d: Check av_scanf()

[Michael Niedermayer]

Fixes: CID1604398 Unchecked return value
Fixes: CID1604542 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_lut3d.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/libavfilter/vf_lut3d.c b/libavfilter/vf_lut3d.c
index d8ceb2a4240..929bf61b877 100644
--- a/libavfilter/vf_lut3d.c
+++ b/libavfilter/vf_lut3d.c
@@ -703,7 +703,8 @@ try_again:
                                 else if (!strncmp(line + 7, "MAX ", 4)) vals = max;
                                 if (!vals)
                                     return AVERROR_INVALIDDATA;
-                                av_sscanf(line + 11, "%f %f %f", vals, vals + 1, vals + 2);
+                                if (av_sscanf(line + 11, "%f %f %f", vals, vals + 1, vals + 2) != 3)
+                                    return AVERROR_INVALIDDATA;
                                 av_log(ctx, AV_LOG_DEBUG, "min: %f %f %f | max: %f %f %f\n",
                                        min[0], min[1], min[2], max[0], max[1], max[2]);
                                 goto try_again;
@@ -1734,12 +1735,14 @@ try_again:
                         else if (!strncmp(line + 7, "MAX ", 4)) vals = max;
                         if (!vals)
                             return AVERROR_INVALIDDATA;
-                        av_sscanf(line + 11, "%f %f %f", vals, vals + 1, vals + 2);
+                        if (av_sscanf(line + 11, "%f %f %f", vals, vals + 1, vals + 2) != 3)
+                            return AVERROR_INVALIDDATA;
                         av_log(ctx, AV_LOG_DEBUG, "min: %f %f %f | max: %f %f %f\n",
                                min[0], min[1], min[2], max[0], max[1], max[2]);
                         goto try_again;
                     } else if (!strncmp(line, "LUT_1D_INPUT_RANGE ", 19)) {
-                        av_sscanf(line + 19, "%f %f", min, max);
+                        if (av_sscanf(line + 19, "%f %f", min, max) != 2)
+                            return AVERROR_INVALIDDATA;
                         min[1] = min[2] = min[0];
                         max[1] = max[2] = max[0];
                         goto try_again;
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/8] avfilter/vf_neighbor_opencl: Use AV_PIX_MAX_PLANES

[Michael Niedermayer]

Fix/Robustness/whatever: CID1439575 Out-of-bounds read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_neighbor_opencl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_neighbor_opencl.c b/libavfilter/vf_neighbor_opencl.c
index b2939f841a2..ba661bd665e 100644
--- a/libavfilter/vf_neighbor_opencl.c
+++ b/libavfilter/vf_neighbor_opencl.c
@@ -42,7 +42,7 @@ typedef struct NeighborOpenCLContext {
 
     char *matrix_str[4];
 
-    cl_float threshold[4];
+    cl_float threshold[AV_VIDEO_MAX_PLANES];
     cl_int coordinates;
     cl_mem coord;
 
@@ -93,7 +93,7 @@ static int neighbor_opencl_make_filter_params(AVFilterContext *avctx)
     cl_int cle;
     int i;
 
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < AV_VIDEO_MAX_PLANES; i++) {
         ctx->threshold[i] /= 255.0;
     }
 
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 5/8] avfilter/vf_premultiply: Use AV_PIX_MAX_PLANES

[Michael Niedermayer]

Helps: CID1435164 Out-of-bounds read
Helps: CID1435165 Out-of-bounds read
Helps: CID1435167 Out-of-bounds read
Helps: CID1435169 Out-of-bounds read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_premultiply.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavfilter/vf_premultiply.c b/libavfilter/vf_premultiply.c
index e077d46a9a0..5e97c2000f2 100644
--- a/libavfilter/vf_premultiply.c
+++ b/libavfilter/vf_premultiply.c
@@ -36,8 +36,8 @@ typedef struct ThreadData {
 
 typedef struct PreMultiplyContext {
     const AVClass *class;
-    int width[4], height[4];
-    int linesize[4];
+    int width[AV_VIDEO_MAX_PLANES], height[AV_VIDEO_MAX_PLANES];
+    int linesize[AV_VIDEO_MAX_PLANES];
     int nb_planes;
     int planes;
     int inverse;
@@ -45,7 +45,7 @@ typedef struct PreMultiplyContext {
     int half, depth, offset, max;
     FFFrameSync fs;
 
-    void (*premultiply[4])(const uint8_t *msrc, const uint8_t *asrc,
+    void (*premultiply[AV_VIDEO_MAX_PLANES])(const uint8_t *msrc, const uint8_t *asrc,
                            uint8_t *dst,
                            ptrdiff_t mlinesize, ptrdiff_t alinesize,
                            ptrdiff_t dlinesize,
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 6/8] avfilter/scale_eval: Use 64bit, check values in ff_scale_adjust_dimensions()

[Michael Niedermayer]

Found by reviewing CID1513722 Operands don't affect result

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/scale_eval.c | 9 ++++++---
 libavfilter/scale_eval.h | 2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/libavfilter/scale_eval.c b/libavfilter/scale_eval.c
index 75ed503f15f..dc8d522b1e3 100644
--- a/libavfilter/scale_eval.c
+++ b/libavfilter/scale_eval.c
@@ -114,7 +114,7 @@ int ff_scale_adjust_dimensions(AVFilterLink *inlink,
     int *ret_w, int *ret_h,
     int force_original_aspect_ratio, int force_divisible_by)
 {
-    int w, h;
+    int64_t w, h;
     int factor_w, factor_h;
 
     w = *ret_w;
@@ -149,9 +149,9 @@ int ff_scale_adjust_dimensions(AVFilterLink *inlink,
      * unless force_divisible_by is defined as well */
     if (force_original_aspect_ratio) {
         // Including force_divisible_by here rounds to the nearest multiple of it.
-        int tmp_w = av_rescale(h, inlink->w, inlink->h * (int64_t)force_divisible_by)
+        int64_t tmp_w = av_rescale(h, inlink->w, inlink->h * (int64_t)force_divisible_by)
                     * force_divisible_by;
-        int tmp_h = av_rescale(w, inlink->h, inlink->w * (int64_t)force_divisible_by)
+        int64_t tmp_h = av_rescale(w, inlink->h, inlink->w * (int64_t)force_divisible_by)
                     * force_divisible_by;
 
         if (force_original_aspect_ratio == 1) {
@@ -173,6 +173,9 @@ int ff_scale_adjust_dimensions(AVFilterLink *inlink,
         }
     }
 
+    if ((int32_t)w != w || (int32_t)h != h)
+        return AVERROR(EINVAL);
+
     *ret_w = w;
     *ret_h = h;
 
diff --git a/libavfilter/scale_eval.h b/libavfilter/scale_eval.h
index 2eb6970aad4..b4895284043 100644
--- a/libavfilter/scale_eval.h
+++ b/libavfilter/scale_eval.h
@@ -41,7 +41,7 @@ int ff_scale_eval_dimensions(void *ctx,
  * force_original_aspect_ratio is set. force_divisible_by is used only when
  * force_original_aspect_ratio is set and must be at least 1.
  *
- * Returns 0.
+ * Returns negative error code on error or non negative on success
  */
 int ff_scale_adjust_dimensions(AVFilterLink *inlink,
     int *ret_w, int *ret_h,
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 7/8] avfilter/vf_scale: Check ff_scale_adjust_dimensions() for failure

[Michael Niedermayer]

Helps: CID1513722 Operands don't affect result

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_scale.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
index 841075193e6..bf09196e10d 100644
--- a/libavfilter/vf_scale.c
+++ b/libavfilter/vf_scale.c
@@ -638,10 +638,13 @@ static int config_props(AVFilterLink *outlink)
     outlink->w = scale->w;
     outlink->h = scale->h;
 
-    ff_scale_adjust_dimensions(inlink, &outlink->w, &outlink->h,
+    ret = ff_scale_adjust_dimensions(inlink, &outlink->w, &outlink->h,
                                scale->force_original_aspect_ratio,
                                scale->force_divisible_by);
 
+    if (ret < 0)
+        goto fail;
+
     if (outlink->w > INT_MAX ||
         outlink->h > INT_MAX ||
         (outlink->h * inlink->w) > INT_MAX ||
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 8/8] avfilter/vf_scale: Cleanup some checks

[Michael Niedermayer]

Fixes: CID1513722 Operands don't affect result

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_scale.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
index bf09196e10d..120ff473f2e 100644
--- a/libavfilter/vf_scale.c
+++ b/libavfilter/vf_scale.c
@@ -645,10 +645,8 @@ static int config_props(AVFilterLink *outlink)
     if (ret < 0)
         goto fail;
 
-    if (outlink->w > INT_MAX ||
-        outlink->h > INT_MAX ||
-        (outlink->h * inlink->w) > INT_MAX ||
-        (outlink->w * inlink->h) > INT_MAX)
+    if ((outlink->h * (int64_t)inlink->w) > INT_MAX ||
+        (outlink->w * (int64_t)inlink->h) > INT_MAX)
         av_log(ctx, AV_LOG_ERROR, "Rescaled value for width or height is too big.\n");
 
     /* TODO: make algorithm configurable */
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 8/8] avfilter/vf_scale: Cleanup some checks

[Anton Khirnov]

Quoting Michael Niedermayer (2024-07-09 00:24:10)
> Fixes: CID1513722 Operands don't affect result
> 
> Sponsored-by: Sovereign Tech Fund
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavfilter/vf_scale.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
> index bf09196e10d..120ff473f2e 100644
> --- a/libavfilter/vf_scale.c
> +++ b/libavfilter/vf_scale.c
> @@ -645,10 +645,8 @@ static int config_props(AVFilterLink *outlink)
>      if (ret < 0)
>          goto fail;
>  
> -    if (outlink->w > INT_MAX ||
> -        outlink->h > INT_MAX ||
> -        (outlink->h * inlink->w) > INT_MAX ||
> -        (outlink->w * inlink->h) > INT_MAX)
> +    if ((outlink->h * (int64_t)inlink->w) > INT_MAX ||
> +        (outlink->w * (int64_t)inlink->h) > INT_MAX)

assumes int is smaller than 64bit

-- 
Anton Khirnov
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/8] avfilter/vf_elbg: Use unsigned for shifting into the top bit

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 687 bytes --]

On Tue, Jul 09, 2024 at 12:24:03AM +0200, Michael Niedermayer wrote:
> Fixes: part of CID1355110 Overflowed constant
> 
> Sponsored-by: Sovereign Tech Fund
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavfilter/vf_elbg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

will apply 1-7 (not 8)

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Old school: Use the lowest level language in which you can solve the problem
            conveniently.
New school: Use the highest level language in which the latest supercomputer
            can solve the problem without the user falling asleep waiting.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".