Re: [FFmpeg-devel] [FFmpeg-cvslog] avformat/wtvdec: Initialize buf

Re: [FFmpeg-devel] [FFmpeg-cvslog] avformat/wtvdec: Initialize buf

[Peter Ross]

[-- Attachment #1.1: Type: text/plain, Size: 1750 bytes --]

On Tue, Jan 21, 2025 at 09:57:43PM +0000, Michael Niedermayer wrote:
> ffmpeg | branch: master | Michael Niedermayer <michael@niedermayer.cc> | Thu Dec 26 02:53:45 2024 +0100| [17b019c517af26c6d2f0c6266938c60d36db1fa3] | committer: Michael Niedermayer
> 
> avformat/wtvdec: Initialize buf
> 
> ff_parse_mpeg2_descriptor() reads over what is initialized
> Fixes: use of uninitialized memory
> Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5144130618982400
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> 
> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=17b019c517af26c6d2f0c6266938c60d36db1fa3
> ---
> 
>  libavformat/wtvdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c
> index 730c7fca78..21c9649869 100644
> --- a/libavformat/wtvdec.c
> +++ b/libavformat/wtvdec.c
> @@ -833,7 +833,7 @@ static int parse_chunks(AVFormatContext *s, int mode, int64_t seekts, int *len_p
>              int stream_index = ff_find_stream_index(s, sid);
>              if (stream_index >= 0) {
>                  AVStream *st = s->streams[stream_index];
> -                uint8_t buf[258];
> +                uint8_t buf[258] = {0};
>                  const uint8_t *pbuf = buf;

hi michael,

can you help me understand why this is needed...
the avio_read() call fills buf, and the call to ff_parse_mpeg2_descriptor
specifies an "end" pointer (desc_list_end point) to prevent overreading.
where is the uninitialised memory coming from?

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [FFmpeg-cvslog] avformat/wtvdec: Initialize buf

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 5772 bytes --]

Hi Peter

On Wed, Jan 22, 2025 at 07:02:07PM +1100, Peter Ross wrote:
> On Tue, Jan 21, 2025 at 09:57:43PM +0000, Michael Niedermayer wrote:
> > ffmpeg | branch: master | Michael Niedermayer <michael@niedermayer.cc> | Thu Dec 26 02:53:45 2024 +0100| [17b019c517af26c6d2f0c6266938c60d36db1fa3] | committer: Michael Niedermayer
> > 
> > avformat/wtvdec: Initialize buf
> > 
> > ff_parse_mpeg2_descriptor() reads over what is initialized
> > Fixes: use of uninitialized memory
> > Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5144130618982400
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > 
> > > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=17b019c517af26c6d2f0c6266938c60d36db1fa3
> > ---
> > 
> >  libavformat/wtvdec.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c
> > index 730c7fca78..21c9649869 100644
> > --- a/libavformat/wtvdec.c
> > +++ b/libavformat/wtvdec.c
> > @@ -833,7 +833,7 @@ static int parse_chunks(AVFormatContext *s, int mode, int64_t seekts, int *len_p
> >              int stream_index = ff_find_stream_index(s, sid);
> >              if (stream_index >= 0) {
> >                  AVStream *st = s->streams[stream_index];
> > -                uint8_t buf[258];
> > +                uint8_t buf[258] = {0};
> >                  const uint8_t *pbuf = buf;
> 
> hi michael,
> 
> can you help me understand why this is needed...
> the avio_read() call fills buf, and the call to ff_parse_mpeg2_descriptor
> specifies an "end" pointer (desc_list_end point) to prevent overreading.
> where is the uninitialised memory coming from?

IIRC the mpegts code doesnt always check before every read that its within end

heres the backtrace

==404==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x556dbc25bb23 in ff_parse_mpeg2_descriptor /src/ffmpeg/libavformat/mpegts.c:2026:13
    #1 0x556dbc3bd380 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:852:17
    #2 0x556dbc3b38cf in read_header /src/ffmpeg/libavformat/wtvdec.c:993:11
    #3 0x556dbc0a4494 in avformat_open_input /src/ffmpeg/libavformat/demux.c:308:20
    #4 0x556dbbff0c6c in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dem_fuzzer.c:202:11
    #5 0x556dbbee61a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #6 0x556dbbed1415 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #7 0x556dbbed6eaf in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #8 0x556dbbf02152 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #9 0x798012026082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
    #10 0x556dbbec95fd in _start
  Uninitialized value was stored to memory at
    #0 0x556dbc25bb1c in ff_parse_mpeg2_descriptor /src/ffmpeg/libavformat/mpegts.c:2026:55
    #1 0x556dbc3bd380 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:852:17
    #2 0x556dbc3b38cf in read_header /src/ffmpeg/libavformat/wtvdec.c:993:11
    #3 0x556dbc0a4494 in avformat_open_input /src/ffmpeg/libavformat/demux.c:308:20
    #4 0x556dbbff0c6c in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dem_fuzzer.c:202:11
    #5 0x556dbbee61a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #6 0x556dbbed1415 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #7 0x556dbbed6eaf in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #8 0x556dbbf02152 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #9 0x798012026082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
  Uninitialized value was stored to memory at
    #0 0x556dbc25b60d in ff_parse_mpeg2_descriptor /src/ffmpeg/libavformat/mpegts.c:2023:33
    #1 0x556dbc3bd380 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:852:17
    #2 0x556dbc3b38cf in read_header /src/ffmpeg/libavformat/wtvdec.c:993:11
    #3 0x556dbc0a4494 in avformat_open_input /src/ffmpeg/libavformat/demux.c:308:20
    #4 0x556dbbff0c6c in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dem_fuzzer.c:202:11
    #5 0x556dbbee61a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #6 0x556dbbed1415 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #7 0x556dbbed6eaf in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #8 0x556dbbf02152 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #9 0x798012026082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
  Uninitialized value was created by an allocation of 'buf' in the stack frame
    #0 0x556dbc3bd186 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:836:17

[...]


-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

There will always be a question for which you do not know the correct answer.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".