Re: [FFmpeg-devel] [PATCH 2/2] avcodec/sanm: avoid using k in left pxoff check

[Michael Niedermayer <michael@niedermayer.cc>]

[-- Attachment #1.1: Type: text/plain, Size: 1903 bytes --]

Hi Manual

On Wed, May 14, 2025 at 03:39:53AM +0200, Michael Niedermayer wrote:
> k is always 4 here and it seems this is not what was intended
> replacing it with 0 works but it may be wrong
> 
> This needs review
> 
> Fixes: out of array read
> Fixes: 409593384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-6488251907244032
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/sanm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

please review, this patch is just written based on gut feeling,
its just clear that the code before was buggy

thx


> 
> diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
> index 00bfef00fe8..ec429e1a002 100644
> --- a/libavcodec/sanm.c
> +++ b/libavcodec/sanm.c
> @@ -734,7 +734,7 @@ static int old_codec4(SANMVideoContext *ctx, GetByteContext *gb, int top, int le
>              }
>  
>              /* smooth top and left block borders with neighbours */
> -            if (((pxoff - p + k) < 0) || ((pxoff - p + k) >= maxpxo)
> +            if (((pxoff - p + 0) < 0) || ((pxoff - p + k) >= maxpxo)
>                  || ((pxoff + 3 * p) < 0) || ((pxoff + 3 * p) >= maxpxo)
>                  || (i == 0) || (j == 0))
>                  continue;
> -- 
> 2.49.0
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
> 

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The smallest minority on earth is the individual. Those who deny 
individual rights cannot claim to be defenders of minorities. - Ayn Rand

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".