[FFmpeg-devel] [PATCH 1/6] avcodec/aac/aacdec: Clear SFO on error

[FFmpeg-devel] [PATCH 1/6] avcodec/aac/aacdec: Clear SFO on error

[Michael Niedermayer]

types and SFO become confused for a USAC stream

Fixes: out of array access
Fixes: 383854203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4996677847547904.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/aac/aacdec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index c0850853b45..8d50ad6d095 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -1747,6 +1747,7 @@ int ff_aac_decode_ics(AACDecContext *ac, SingleChannelElement *sce,
 
     return 0;
 fail:
+    memset(sce->sfo, 0, sizeof(sce->sfo));
     tns->present = 0;
     return ret;
 }
-- 
2.48.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/6] avcodec/aac/aacdec_usac: Simplify decode_usac_scale_factors()

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/aac/aacdec_usac.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index 2938e693874..ccdf58bc8e2 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -567,15 +567,8 @@ static int decode_usac_scale_factors(AACDecContext *ac,
     int offset_sf = global_gain;
     for (int g = 0; g < ics->num_window_groups; g++) {
         for (int sfb = 0; sfb < ics->max_sfb; sfb++) {
-            /* First coefficient is just the global gain */
-            if (!g && !sfb) {
-                /* The cannonical representation of quantized scalefactors
-                 * in the spec is with 100 subtracted. */
-                sce->sfo[0] = offset_sf - 100;
-                continue;
-            }
-
-            offset_sf += get_vlc2(gb, ff_vlc_scalefactors, 7, 3) - SCALE_DIFF_ZERO;
+            if (g || sfb)
+                offset_sf += get_vlc2(gb, ff_vlc_scalefactors, 7, 3) - SCALE_DIFF_ZERO;
             if (offset_sf > 255U) {
                 av_log(ac->avctx, AV_LOG_ERROR,
                        "Scalefactor (%d) out of range.\n", offset_sf);
-- 
2.48.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/6] avcodec/aac/aacdec_usac: Fix memory deallocation of pl_data

[Michael Niedermayer]

Fixes: double free
Fixes: 393523547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6740617236905984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/aac/aacdec.c      | 19 +++++++++++++++++--
 libavcodec/aac/aacdec_usac.c |  3 ++-
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 8d50ad6d095..16259b5ada9 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -421,6 +421,21 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags)
     return layout;
 }
 
+static void copy_oc(OutputConfiguration *dst, OutputConfiguration *src)
+{
+    int err = 0;
+
+    for(int i = 0; i < dst->usac.nb_elems; i++)
+        av_freep(&dst->usac.elems[i].ext.pl_data);
+
+    *dst = *src;
+
+    for(int i = 0; i < dst->usac.nb_elems; i++) {
+        AACUsacElemConfig *e = &dst->usac.elems[i];
+        e->ext.pl_data = av_memdup(e->ext.pl_data, e->ext.pl_data_offset);
+    }
+}
+
 /**
  * Save current output configuration if and only if it has been locked.
  */
@@ -429,7 +444,7 @@ static int push_output_configuration(AACDecContext *ac)
     int pushed = 0;
 
     if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) {
-        ac->oc[0] = ac->oc[1];
+        copy_oc(&ac->oc[0], &ac->oc[1]);
         pushed = 1;
     }
     ac->oc[1].status = OC_NONE;
@@ -443,7 +458,7 @@ static int push_output_configuration(AACDecContext *ac)
 static void pop_output_configuration(AACDecContext *ac)
 {
     if (ac->oc[1].status != OC_LOCKED && ac->oc[0].status != OC_NONE) {
-        ac->oc[1] = ac->oc[0];
+        copy_oc(&ac->oc[1], &ac->oc[0]);
         ac->avctx->ch_layout = ac->oc[1].ch_layout;
         ff_aac_output_configure(ac, ac->oc[1].layout_map, ac->oc[1].layout_map_tags,
                                 ac->oc[1].status, 0);
diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index ccdf58bc8e2..e6f86b4a677 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -1604,7 +1604,8 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
     if (!(pl_frag_start && pl_frag_end)) {
         tmp = av_realloc(e->ext.pl_data, e->ext.pl_data_offset + len);
         if (!tmp) {
-            av_free(e->ext.pl_data);
+            av_freep(&e->ext.pl_data);
+            e->ext.pl_data_offset = 0;
             return AVERROR(ENOMEM);
         }
         e->ext.pl_data = tmp;
-- 
2.48.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/6] avcodec/aac/aacdec_usac: Fix memory deallocation of pl_data

[Andreas Rheinhardt]

Michael Niedermayer:
> Fixes: double free
> Fixes: 393523547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6740617236905984
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/aac/aacdec.c      | 19 +++++++++++++++++--
>  libavcodec/aac/aacdec_usac.c |  3 ++-
>  2 files changed, 19 insertions(+), 3 deletions(-)
> 
> diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
> index 8d50ad6d095..16259b5ada9 100644
> --- a/libavcodec/aac/aacdec.c
> +++ b/libavcodec/aac/aacdec.c
> @@ -421,6 +421,21 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags)
>      return layout;
>  }
>  
> +static void copy_oc(OutputConfiguration *dst, OutputConfiguration *src)
> +{
> +    int err = 0;

Seems unused.

> +
> +    for(int i = 0; i < dst->usac.nb_elems; i++)
> +        av_freep(&dst->usac.elems[i].ext.pl_data);
> +
> +    *dst = *src;
> +
> +    for(int i = 0; i < dst->usac.nb_elems; i++) {
> +        AACUsacElemConfig *e = &dst->usac.elems[i];
> +        e->ext.pl_data = av_memdup(e->ext.pl_data, e->ext.pl_data_offset);

Unchecked allocation. Furthermore, the *dst = *src makes cleanup on
error here a PITA. Would making pl_data reference-counted (via
RefStruct) work instead?

> +    }
> +}
> +
>  /**
>   * Save current output configuration if and only if it has been locked.
>   */
> @@ -429,7 +444,7 @@ static int push_output_configuration(AACDecContext *ac)
>      int pushed = 0;
>  
>      if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) {
> -        ac->oc[0] = ac->oc[1];
> +        copy_oc(&ac->oc[0], &ac->oc[1]);
>          pushed = 1;
>      }
>      ac->oc[1].status = OC_NONE;
> @@ -443,7 +458,7 @@ static int push_output_configuration(AACDecContext *ac)
>  static void pop_output_configuration(AACDecContext *ac)
>  {
>      if (ac->oc[1].status != OC_LOCKED && ac->oc[0].status != OC_NONE) {
> -        ac->oc[1] = ac->oc[0];
> +        copy_oc(&ac->oc[1], &ac->oc[0]);
>          ac->avctx->ch_layout = ac->oc[1].ch_layout;
>          ff_aac_output_configure(ac, ac->oc[1].layout_map, ac->oc[1].layout_map_tags,
>                                  ac->oc[1].status, 0);
> diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
> index ccdf58bc8e2..e6f86b4a677 100644
> --- a/libavcodec/aac/aacdec_usac.c
> +++ b/libavcodec/aac/aacdec_usac.c
> @@ -1604,7 +1604,8 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
>      if (!(pl_frag_start && pl_frag_end)) {
>          tmp = av_realloc(e->ext.pl_data, e->ext.pl_data_offset + len);
>          if (!tmp) {
> -            av_free(e->ext.pl_data);
> +            av_freep(&e->ext.pl_data);
> +            e->ext.pl_data_offset = 0;
>              return AVERROR(ENOMEM);
>          }
>          e->ext.pl_data = tmp;

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/6] avcodec/aac/aacdec_lpd: Limit get_unary()

[Michael Niedermayer]

The limit is based on later code storing 32bits

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 393164866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4606798354513920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/aac/aacdec_lpd.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/libavcodec/aac/aacdec_lpd.c b/libavcodec/aac/aacdec_lpd.c
index 20bbb007ff3..a4b91a510f4 100644
--- a/libavcodec/aac/aacdec_lpd.c
+++ b/libavcodec/aac/aacdec_lpd.c
@@ -62,7 +62,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn)
 {
     if (nk_mode == 1) {
         for (int k = 0; k < no_qn; k++) {
-            qn[k] = get_unary(gb, 0, INT32_MAX); // TODO: find proper ranges
+            qn[k] = get_unary(gb, 0, 68); // TODO: find proper ranges
             if (qn[k])
                 qn[k]++;
         }
@@ -75,7 +75,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn)
     if (nk_mode == 2) {
         for (int k = 0; k < no_qn; k++) {
             if (qn[k] > 4) {
-                qn[k] = get_unary(gb, 0, INT32_MAX);;
+                qn[k] = get_unary(gb, 0, 65);
                 if (qn[k])
                     qn[k] += 4;
             }
@@ -85,7 +85,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn)
 
     for (int k = 0; k < no_qn; k++) {
         if (qn[k] > 4) {
-            int qn_ext = get_unary(gb, 0, INT32_MAX);;
+            int qn_ext = get_unary(gb, 0, 65);
             switch (qn_ext) {
             case 0: qn[k] = 5; break;
             case 1: qn[k] = 6; break;
@@ -114,6 +114,9 @@ static int parse_codebook_idx(GetBitContext *gb, uint32_t *kv,
         }
     }
 
+    if (nk > 25)
+        return AVERROR_PATCHWELCOME;
+
     skip_bits(gb, 4*n);
 
     if (nk > 0)
-- 
2.48.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 5/6] avformat/iff: Check that we have a stream in read_dst_frame()

[Michael Niedermayer]

Fixes: null pointer dereference
Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/iff.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/iff.c b/libavformat/iff.c
index 38f90dd81cb..7142a06e98f 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -364,6 +364,9 @@ static int read_dst_frame(AVFormatContext *s, AVPacket *pkt)
     uint64_t chunk_pos, data_pos, data_size;
     int ret = AVERROR_EOF;
 
+    if (s->nb_streams < 1)
+        return AVERROR_INVALIDDATA;
+
     while (!avio_feof(pb)) {
         chunk_pos = avio_tell(pb);
         if (chunk_pos >= iff->body_end)
-- 
2.48.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 5/6] avformat/iff: Check that we have a stream in read_dst_frame()

[Peter Ross]

[-- Attachment #1.1: Type: text/plain, Size: 1059 bytes --]

On Sun, Feb 09, 2025 at 03:24:20AM +0100, Michael Niedermayer wrote:
> Fixes: null pointer dereference
> Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/iff.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/libavformat/iff.c b/libavformat/iff.c
> index 38f90dd81cb..7142a06e98f 100644
> --- a/libavformat/iff.c
> +++ b/libavformat/iff.c
> @@ -364,6 +364,9 @@ static int read_dst_frame(AVFormatContext *s, AVPacket *pkt)
>      uint64_t chunk_pos, data_pos, data_size;
>      int ret = AVERROR_EOF;
>  
> +    if (s->nb_streams < 1)
> +        return AVERROR_INVALIDDATA;
> +
>      while (!avio_feof(pb)) {
>          chunk_pos = avio_tell(pb);
>          if (chunk_pos >= iff->body_end)
> -- 
> 2.48.1

please apply, thanks.

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 6/6] avcodec/rv60dec: Initialize slice gb with actually allocated size

[Michael Niedermayer]

Fixes: out of array access
Fixes: 385170375/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-4710055187906560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/rv60dec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c
index 0c2e03d7370..24981015a94 100644
--- a/libavcodec/rv60dec.c
+++ b/libavcodec/rv60dec.c
@@ -2257,7 +2257,7 @@ static int decode_slice(AVCodecContext *avctx, void *tdata, int cu_y, int thread
     thread.avg_linesize[1] = 32;
     thread.avg_linesize[2] = 32;
 
-    if ((ret = init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].size)) < 0)
+    if ((ret = init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].data_size)) < 0)
         return ret;
 
     for (int cu_x = 0; cu_x < s->cu_width; cu_x++) {
-- 
2.48.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 6/6] avcodec/rv60dec: Initialize slice gb with actually allocated size

[Peter Ross]

[-- Attachment #1.1: Type: text/plain, Size: 1174 bytes --]

On Sun, Feb 09, 2025 at 03:24:21AM +0100, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: 385170375/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-4710055187906560
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/rv60dec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c
> index 0c2e03d7370..24981015a94 100644
> --- a/libavcodec/rv60dec.c
> +++ b/libavcodec/rv60dec.c
> @@ -2257,7 +2257,7 @@ static int decode_slice(AVCodecContext *avctx, void *tdata, int cu_y, int thread
>      thread.avg_linesize[1] = 32;
>      thread.avg_linesize[2] = 32;
>  
> -    if ((ret = init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].size)) < 0)
> +    if ((ret = init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].data_size)) < 0)
>          return ret;
>  
>      for (int cu_x = 0; cu_x < s->cu_width; cu_x++) {

nice find. please apply, thanks.

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".