From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id B86A34BF69 for ; Wed, 22 Jan 2025 14:49:49 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 29C0068B3FC; Wed, 22 Jan 2025 16:49:45 +0200 (EET) Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [217.70.183.194]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 88B8D68806D for ; Wed, 22 Jan 2025 16:49:38 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id C4C9040009 for ; Wed, 22 Jan 2025 14:49:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1737557377; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=fWy6/D1BMljlUVW2rQwQ/0faDYOXEgHk1RFQbBEW6TY=; b=CwLdvMuj7tqbWe8/VReQDnjEvyrcYXhXYMdFqfUM+bgsHGfnZ0qAp7c9L6LKeKJE2t2o+2 7Lr3k6rBA+3SsObH+W0iXTZMS7Y99opSOogcgeLdEriPwc5eDaJi/B10D1hFaow0/vzJRd 79wyuhUPB916BjLjTCaEVPK30Wa2bzLaEx+vQvWMQns7ZhmGCWUOPDTwUaGLg+QuKBtrJH jSNVRIRaSMbor8t+aNAaDRsF1vb7x0runmZdPczepu19NNVt5eB6rmeYgpmOyCH5yLBtYi ewUuc/ng4+VN1tHF9JOOv9Udble547bMeFA8buF5POfwq5veM1mWjZlnprZbmg== Date: Wed, 22 Jan 2025 15:49:36 +0100 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20250122144936.GW4991@pb2> References: <20250121215744.2CBC24126D3@natalya.videolan.org> MIME-Version: 1.0 In-Reply-To: X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [FFmpeg-cvslog] avformat/wtvdec: Initialize buf X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============4723101540232492137==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============4723101540232492137== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Nc76PBNN/fryFK5J" Content-Disposition: inline --Nc76PBNN/fryFK5J Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi Peter On Wed, Jan 22, 2025 at 07:02:07PM +1100, Peter Ross wrote: > On Tue, Jan 21, 2025 at 09:57:43PM +0000, Michael Niedermayer wrote: > > ffmpeg | branch: master | Michael Niedermayer = | Thu Dec 26 02:53:45 2024 +0100| [17b019c517af26c6d2f0c6266938c60d36db1fa3= ] | committer: Michael Niedermayer > >=20 > > avformat/wtvdec: Initialize buf > >=20 > > ff_parse_mpeg2_descriptor() reads over what is initialized > > Fixes: use of uninitialized memory > > Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5= 144130618982400 > >=20 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz= /tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer > >=20 > > > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=3Dcommit;h=3D17b019c= 517af26c6d2f0c6266938c60d36db1fa3 > > --- > >=20 > > libavformat/wtvdec.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > >=20 > > diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c > > index 730c7fca78..21c9649869 100644 > > --- a/libavformat/wtvdec.c > > +++ b/libavformat/wtvdec.c > > @@ -833,7 +833,7 @@ static int parse_chunks(AVFormatContext *s, int mod= e, int64_t seekts, int *len_p > > int stream_index =3D ff_find_stream_index(s, sid); > > if (stream_index >=3D 0) { > > AVStream *st =3D s->streams[stream_index]; > > - uint8_t buf[258]; > > + uint8_t buf[258] =3D {0}; > > const uint8_t *pbuf =3D buf; >=20 > hi michael, >=20 > can you help me understand why this is needed... > the avio_read() call fills buf, and the call to ff_parse_mpeg2_descriptor > specifies an "end" pointer (desc_list_end point) to prevent overreading. > where is the uninitialised memory coming from? IIRC the mpegts code doesnt always check before every read that its within = end heres the backtrace =3D=3D404=3D=3DWARNING: MemorySanitizer: use-of-uninitialized-value #0 0x556dbc25bb23 in ff_parse_mpeg2_descriptor /src/ffmpeg/libavformat/= mpegts.c:2026:13 #1 0x556dbc3bd380 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:852:= 17 #2 0x556dbc3b38cf in read_header /src/ffmpeg/libavformat/wtvdec.c:993:11 #3 0x556dbc0a4494 in avformat_open_input /src/ffmpeg/libavformat/demux.= c:308:20 #4 0x556dbbff0c6c in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_de= m_fuzzer.c:202:11 #5 0x556dbbee61a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char cons= t*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:= 614:13 #6 0x556dbbed1415 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, u= nsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327= :6 #7 0x556dbbed6eaf in fuzzer::FuzzerDriver(int*, char***, int (*)(unsign= ed char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/Fu= zzerDriver.cpp:862:9 #8 0x556dbbf02152 in main /src/llvm-project/compiler-rt/lib/fuzzer/Fuzz= erMain.cpp:20:10 #9 0x798012026082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/c= su/libc-start.c:308:16 #10 0x556dbbec95fd in _start Uninitialized value was stored to memory at #0 0x556dbc25bb1c in ff_parse_mpeg2_descriptor /src/ffmpeg/libavformat/= mpegts.c:2026:55 #1 0x556dbc3bd380 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:852:= 17 #2 0x556dbc3b38cf in read_header /src/ffmpeg/libavformat/wtvdec.c:993:11 #3 0x556dbc0a4494 in avformat_open_input /src/ffmpeg/libavformat/demux.= c:308:20 #4 0x556dbbff0c6c in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_de= m_fuzzer.c:202:11 #5 0x556dbbee61a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char cons= t*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:= 614:13 #6 0x556dbbed1415 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, u= nsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327= :6 #7 0x556dbbed6eaf in fuzzer::FuzzerDriver(int*, char***, int (*)(unsign= ed char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/Fu= zzerDriver.cpp:862:9 #8 0x556dbbf02152 in main /src/llvm-project/compiler-rt/lib/fuzzer/Fuzz= erMain.cpp:20:10 #9 0x798012026082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/c= su/libc-start.c:308:16 Uninitialized value was stored to memory at #0 0x556dbc25b60d in ff_parse_mpeg2_descriptor /src/ffmpeg/libavformat/= mpegts.c:2023:33 #1 0x556dbc3bd380 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:852:= 17 #2 0x556dbc3b38cf in read_header /src/ffmpeg/libavformat/wtvdec.c:993:11 #3 0x556dbc0a4494 in avformat_open_input /src/ffmpeg/libavformat/demux.= c:308:20 #4 0x556dbbff0c6c in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_de= m_fuzzer.c:202:11 #5 0x556dbbee61a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char cons= t*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:= 614:13 #6 0x556dbbed1415 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, u= nsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327= :6 #7 0x556dbbed6eaf in fuzzer::FuzzerDriver(int*, char***, int (*)(unsign= ed char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/Fu= zzerDriver.cpp:862:9 #8 0x556dbbf02152 in main /src/llvm-project/compiler-rt/lib/fuzzer/Fuzz= erMain.cpp:20:10 #9 0x798012026082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/c= su/libc-start.c:308:16 Uninitialized value was created by an allocation of 'buf' in the stack fr= ame #0 0x556dbc3bd186 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:836:= 17 [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB There will always be a question for which you do not know the correct answe= r. --Nc76PBNN/fryFK5J Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZ5EFfAAKCRBhHseHBAsP q/vyAJ9ttU5gLusV7CZsc04jzq4mi5XavQCeIhh1vhRXprCEBw5JcdA7hsMKzR4= =vIHH -----END PGP SIGNATURE----- --Nc76PBNN/fryFK5J-- --===============4723101540232492137== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============4723101540232492137==--