* Re: [FFmpeg-devel] [FFmpeg-cvslog] avformat/wtvdec: Initialize buf
2025-01-22 8:02 ` [FFmpeg-devel] [FFmpeg-cvslog] avformat/wtvdec: Initialize buf Peter Ross
@ 2025-01-22 14:49 ` Michael Niedermayer
0 siblings, 0 replies; 2+ messages in thread
From: Michael Niedermayer @ 2025-01-22 14:49 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 5772 bytes --]
Hi Peter
On Wed, Jan 22, 2025 at 07:02:07PM +1100, Peter Ross wrote:
> On Tue, Jan 21, 2025 at 09:57:43PM +0000, Michael Niedermayer wrote:
> > ffmpeg | branch: master | Michael Niedermayer <michael@niedermayer.cc> | Thu Dec 26 02:53:45 2024 +0100| [17b019c517af26c6d2f0c6266938c60d36db1fa3] | committer: Michael Niedermayer
> >
> > avformat/wtvdec: Initialize buf
> >
> > ff_parse_mpeg2_descriptor() reads over what is initialized
> > Fixes: use of uninitialized memory
> > Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5144130618982400
> >
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> >
> > > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=17b019c517af26c6d2f0c6266938c60d36db1fa3
> > ---
> >
> > libavformat/wtvdec.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c
> > index 730c7fca78..21c9649869 100644
> > --- a/libavformat/wtvdec.c
> > +++ b/libavformat/wtvdec.c
> > @@ -833,7 +833,7 @@ static int parse_chunks(AVFormatContext *s, int mode, int64_t seekts, int *len_p
> > int stream_index = ff_find_stream_index(s, sid);
> > if (stream_index >= 0) {
> > AVStream *st = s->streams[stream_index];
> > - uint8_t buf[258];
> > + uint8_t buf[258] = {0};
> > const uint8_t *pbuf = buf;
>
> hi michael,
>
> can you help me understand why this is needed...
> the avio_read() call fills buf, and the call to ff_parse_mpeg2_descriptor
> specifies an "end" pointer (desc_list_end point) to prevent overreading.
> where is the uninitialised memory coming from?
IIRC the mpegts code doesnt always check before every read that its within end
heres the backtrace
==404==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x556dbc25bb23 in ff_parse_mpeg2_descriptor /src/ffmpeg/libavformat/mpegts.c:2026:13
#1 0x556dbc3bd380 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:852:17
#2 0x556dbc3b38cf in read_header /src/ffmpeg/libavformat/wtvdec.c:993:11
#3 0x556dbc0a4494 in avformat_open_input /src/ffmpeg/libavformat/demux.c:308:20
#4 0x556dbbff0c6c in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dem_fuzzer.c:202:11
#5 0x556dbbee61a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
#6 0x556dbbed1415 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
#7 0x556dbbed6eaf in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
#8 0x556dbbf02152 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#9 0x798012026082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
#10 0x556dbbec95fd in _start
Uninitialized value was stored to memory at
#0 0x556dbc25bb1c in ff_parse_mpeg2_descriptor /src/ffmpeg/libavformat/mpegts.c:2026:55
#1 0x556dbc3bd380 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:852:17
#2 0x556dbc3b38cf in read_header /src/ffmpeg/libavformat/wtvdec.c:993:11
#3 0x556dbc0a4494 in avformat_open_input /src/ffmpeg/libavformat/demux.c:308:20
#4 0x556dbbff0c6c in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dem_fuzzer.c:202:11
#5 0x556dbbee61a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
#6 0x556dbbed1415 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
#7 0x556dbbed6eaf in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
#8 0x556dbbf02152 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#9 0x798012026082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
Uninitialized value was stored to memory at
#0 0x556dbc25b60d in ff_parse_mpeg2_descriptor /src/ffmpeg/libavformat/mpegts.c:2023:33
#1 0x556dbc3bd380 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:852:17
#2 0x556dbc3b38cf in read_header /src/ffmpeg/libavformat/wtvdec.c:993:11
#3 0x556dbc0a4494 in avformat_open_input /src/ffmpeg/libavformat/demux.c:308:20
#4 0x556dbbff0c6c in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dem_fuzzer.c:202:11
#5 0x556dbbee61a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
#6 0x556dbbed1415 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
#7 0x556dbbed6eaf in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
#8 0x556dbbf02152 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#9 0x798012026082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
Uninitialized value was created by an allocation of 'buf' in the stack frame
#0 0x556dbc3bd186 in parse_chunks /src/ffmpeg/libavformat/wtvdec.c:836:17
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
There will always be a question for which you do not know the correct answer.
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 2+ messages in thread