[FFmpeg-devel] [PATCH 1/3] avformat/flvdec: Set last_ts before its timestamp is lost in ff_buffer_packet()

[FFmpeg-devel] [PATCH 1/3] avformat/flvdec: Set last_ts before its timestamp is lost in ff_buffer_packet()

[Michael Niedermayer]

Fixes: signed integer overflow: -9223372036315799519 + -9223372036854775807 cannot be represented in type 'long'
Fixes: 398356258/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-4905723095482368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/flvdec.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index b90ed34b1c5..8af317f3cc9 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -1852,6 +1852,7 @@ retry_duration:
             stream_type == FLV_STREAM_TYPE_DATA)
             pkt->flags |= AV_PKT_FLAG_KEY;
 
+        flv->last_ts = pkt->dts;
         ret = ff_buffer_packet(s, pkt);
         if (ret < 0)
             return ret;
@@ -1906,8 +1907,6 @@ leave:
         }
     }
 
-    if (ret >= 0)
-        flv->last_ts = pkt->dts;
 
     return ret ? ret : res;
 }
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/3] avformat/avidec: Ignore duplicate GAB2

[Michael Niedermayer]

Fixes: memleak
Fixes: 398401912/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4669849976766464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/avidec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index 1ae09efc150..81a0ae31bab 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -1122,6 +1122,10 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt)
         int size;
         AVProbeData pd;
         unsigned int desc_len;
+
+        if (ast->sub_ctx)
+            return 0;
+
         AVIOContext *pb = avio_alloc_context(pkt->data + 7,
                                              pkt->size - 7,
                                              0, NULL, NULL, NULL, NULL);
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/3] avformat/avidec: Ignore duplicate GAB2

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 635 bytes --]

On Sat, May 10, 2025 at 04:36:07PM +0200, Michael Niedermayer wrote:
> Fixes: memleak
> Fixes: 398401912/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4669849976766464
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/avidec.c | 4 ++++
>  1 file changed, 4 insertions(+)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

What is kyc? Its a tool that makes you give out your real ID, while criminals
give out a forged ID card.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/3] avformat/iamf_parse: check space left for AAC

[Michael Niedermayer]

Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406
Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/iamf_parse.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index abedfdb0668..37fb25962c4 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -304,6 +304,8 @@ static int update_extradata(AVCodecParameters *codecpar)
         skip_bits(&gb, 4);
         put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config
         ret = put_bits_left(&pb);
+        if (ret < 0)
+            return AVERROR_INVALIDDATA;
         put_bits(&pb, ret, get_bits_long(&gb, ret));
         flush_put_bits(&pb);
 
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] avformat/iamf_parse: check space left for AAC

[James Almer]

[-- Attachment #1.1.1: Type: text/plain, Size: 1182 bytes --]

On 5/10/2025 11:36 AM, Michael Niedermayer wrote:
> Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406
> Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavformat/iamf_parse.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
> index abedfdb0668..37fb25962c4 100644
> --- a/libavformat/iamf_parse.c
> +++ b/libavformat/iamf_parse.c
> @@ -304,6 +304,8 @@ static int update_extradata(AVCodecParameters *codecpar)
>           skip_bits(&gb, 4);
>           put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config
>           ret = put_bits_left(&pb);
> +        if (ret < 0)
> +            return AVERROR_INVALIDDATA;
>           put_bits(&pb, ret, get_bits_long(&gb, ret));
>           flush_put_bits(&pb);

No, there's something wrong because the buffer for PutBytes is fixed and 
local. Maybe 5 bytes was not enough.

Will have a look.


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".