[FFmpeg-devel] [PATCH 1/2] avcodec/pngdec: avoid erroring with sBIT on indexed-color images

[FFmpeg-devel] [PATCH 1/2] avcodec/pngdec: avoid erroring with sBIT on indexed-color images

[Leo Izen]

Indexed color images use three colors for sBIT, but the function
ff_png_get_nb_channels returns 1 in this case. We should avoid erroring
out on valid files in this scenario.

Signed-off-by: Leo Izen <leo.izen@gmail.com>
Reported-by: Ramiro Polla <ramiro.polla@gmail.com>
---
 libavcodec/pngdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index 180806e5e1..b0d02c97dd 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -1084,7 +1084,7 @@ static int decode_sbit_chunk(AVCodecContext *avctx, PNGDecContext *s,
         return AVERROR_INVALIDDATA;
     }
 
-    channels = ff_png_get_nb_channels(s->color_type);
+    channels = s->color_type & PNG_COLOR_MASK_PALETTE ? 3 : ff_png_get_nb_channels(s->color_type);
 
     if (bytestream2_get_bytes_left(gb) != channels)
         return AVERROR_INVALIDDATA;
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avcodec/png: more informative error message for invalid sBIT size

[Leo Izen]

If the sBIT chunk size is invalid, we should print a more informative
error message rather than return an error and print nothing.

Signed-off-by: Leo Izen <leo.izen@gmail.com>
---
 libavcodec/pngdec.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index b0d02c97dd..cb861e5f60 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -1086,8 +1086,11 @@ static int decode_sbit_chunk(AVCodecContext *avctx, PNGDecContext *s,
 
     channels = s->color_type & PNG_COLOR_MASK_PALETTE ? 3 : ff_png_get_nb_channels(s->color_type);
 
-    if (bytestream2_get_bytes_left(gb) != channels)
+    if (bytestream2_get_bytes_left(gb) != channels) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid sBIT size: %d, expected: %d\n",
+            bytestream2_get_bytes_left(gb), channels);
         return AVERROR_INVALIDDATA;
+    }
 
     for (int i = 0; i < channels; i++) {
         int b = bytestream2_get_byteu(gb);
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/png: more informative error message for invalid sBIT size

[Paul B Mahol]

You are deeply confused.


Checking with != for overread bytes is wrong.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/png: more informative error message for invalid sBIT size

[Leo Izen]

On 7/12/24 3:03 PM, Leo Izen wrote:
> If the sBIT chunk size is invalid, we should print a more informative
> error message rather than return an error and print nothing.
> 
> Signed-off-by: Leo Izen <leo.izen@gmail.com>
> ---
>   libavcodec/pngdec.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 

Will merge soon.

- Leo Izen (Traneptora)

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/pngdec: avoid erroring with sBIT on indexed-color images

[Marton Balint]

On Fri, 12 Jul 2024, Leo Izen wrote:

> Indexed color images use three colors for sBIT, but the function
> ff_png_get_nb_channels returns 1 in this case. We should avoid erroring
> out on valid files in this scenario.

Please mention that this is a regression since 
84b454935fae2633a8a5dd075e22393f3e8f932f.

>
> Signed-off-by: Leo Izen <leo.izen@gmail.com>
> Reported-by: Ramiro Polla <ramiro.polla@gmail.com>
> ---
> libavcodec/pngdec.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
> index 180806e5e1..b0d02c97dd 100644
> --- a/libavcodec/pngdec.c
> +++ b/libavcodec/pngdec.c
> @@ -1084,7 +1084,7 @@ static int decode_sbit_chunk(AVCodecContext *avctx, PNGDecContext *s,
>         return AVERROR_INVALIDDATA;
>     }
>
> -    channels = ff_png_get_nb_channels(s->color_type);
> +    channels = s->color_type & PNG_COLOR_MASK_PALETTE ? 3 : ff_png_get_nb_channels(s->color_type);
>

LGTM, also please backport this to the affected branches!

Thanks,
Marton


>     if (bytestream2_get_bytes_left(gb) != channels)
>         return AVERROR_INVALIDDATA;
> -- 
> 2.45.2
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/pngdec: avoid erroring with sBIT on indexed-color images

[Leo Izen]

On 7/18/24 4:47 AM, Marton Balint wrote:
> 
> 
> On Fri, 12 Jul 2024, Leo Izen wrote:
> 
>> Indexed color images use three colors for sBIT, but the function
>> ff_png_get_nb_channels returns 1 in this case. We should avoid erroring
>> out on valid files in this scenario.
> 
> Please mention that this is a regression since 
> 84b454935fae2633a8a5dd075e22393f3e8f932f.
> 
> 
> LGTM, also please backport this to the affected branches!
> 
> Thanks,
> Marton
> 
> 

Sure, I'll put it in the commit message when I commit it, and I'll 
backport it to the branches that also contain that commit.

- Leo Izen (Traneptora)
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".