[FFmpeg-devel] [PATCH 1/5] avformat/mov: Check that sample_count is allocated in mov_parse_heif_items()

[FFmpeg-devel] [PATCH 1/5] avformat/mov: Check that sample_count is allocated in mov_parse_heif_items()

[Michael Niedermayer]

Fixes: NULL pointer dereference
Fixes: 416811958/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5425269114732544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 8a094b1ea0a..6e9e3498fb5 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10336,7 +10336,7 @@ static int mov_parse_heif_items(AVFormatContext *s)
         st->codecpar->height = item->height;
 
         err = sanity_checks(s, sc, item->item_id);
-        if (err)
+        if (err || !sc->sample_count)
             return AVERROR_INVALIDDATA;
 
         sc->sample_sizes[0]  = item->extent_length;
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/5] avformat/mov: Check edit_list_dts_entry_end

[Michael Niedermayer]

Fixes: signed integer overflow: 5269246886373498912 + 4035225266123964416 cannot be represented in type 'long'
Fixes: 418319157/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5452638340841472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mov.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 6e9e3498fb5..401fdf70fb4 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4245,6 +4245,10 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
                st->index, edit_list_index, edit_list_media_time, edit_list_duration);
         edit_list_index++;
         edit_list_dts_counter = edit_list_dts_entry_end;
+        if (av_sat_add64(edit_list_dts_entry_end, edit_list_duration) != edit_list_dts_entry_end + (uint64_t)edit_list_duration) {
+            av_log(mov->fc, AV_LOG_ERROR, "edit_list_durations sum exceed 64bit\n");
+            break;
+        }
         edit_list_dts_entry_end += edit_list_duration;
         num_discarded_begin = 0;
         if (!found_non_empty_edit && edit_list_media_time == -1) {
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/5] avcodec/rv60dec: Check sum in read_slice_sizes()

[Michael Niedermayer]

Fixes: signed integer overflow: 2147483647 + 1913651185 cannot be represented in type 'int'
Fixes: 418335931/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-6568264620900352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/rv60dec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c
index 2bbcb1d6209..dbafa7eed02 100644
--- a/libavcodec/rv60dec.c
+++ b/libavcodec/rv60dec.c
@@ -409,6 +409,8 @@ static int read_slice_sizes(RV60Context *s, GetBitContext *gb)
         if (last_size <= 0)
             return AVERROR_INVALIDDATA;
         s->slice[i].size = last_size;
+        if (s->slice[i].size > INT32_MAX - sum)
+            return AVERROR_INVALIDDATA;
         sum += s->slice[i].size;
     }
 
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/5] avformat/iff: Check nb_channels == 0 in CHNL

[Michael Niedermayer]

Fixes: division by 0
Fixes: 418396712/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6104388018176000
Fixes: 418478219/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4569544410857472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/iff.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/iff.c b/libavformat/iff.c
index 9402be48c98..4ff10beb38a 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -284,7 +284,7 @@ static int parse_dsd_prop(AVFormatContext *s, AVStream *st, uint64_t eof)
                 return AVERROR_INVALIDDATA;
             st->codecpar->ch_layout.order       = AV_CHANNEL_ORDER_UNSPEC;
             st->codecpar->ch_layout.nb_channels = avio_rb16(pb);
-            if (size < 2 + st->codecpar->ch_layout.nb_channels * 4)
+            if (size < 2 + st->codecpar->ch_layout.nb_channels * 4 || !st->codecpar->ch_layout.nb_channels)
                 return AVERROR_INVALIDDATA;
             if (st->codecpar->ch_layout.nb_channels > FF_ARRAY_ELEMS(dsd_layout)) {
                 avpriv_request_sample(s, "channel layout");
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 5/5] avcodec/cbs_apv_syntax_template: Check tile_data_size

[Michael Niedermayer]

Fixes: heap-buffer-overflow
Fixes: 418421333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APV_fuzzer-6592025183191040
Fixes: 418804929/clusterfuzz-testcase-minimized-ffmpeg_BSF_APV_METADATA_fuzzer-5773904646045696
Fixes: 420737045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APV_fuzzer-5535272169439232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/cbs_apv_syntax_template.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/cbs_apv_syntax_template.c b/libavcodec/cbs_apv_syntax_template.c
index fc8a08ff31d..b84565b1076 100644
--- a/libavcodec/cbs_apv_syntax_template.c
+++ b/libavcodec/cbs_apv_syntax_template.c
@@ -236,6 +236,8 @@ static int FUNC(tile)(CodedBitstreamContext *ctx, RWContext *rw,
 #ifdef READ
         int pos = get_bits_count(rw);
         av_assert0(pos % 8 == 0);
+        if (get_bits_left(rw) < 8LL * comp_size)
+            return AVERROR_INVALIDDATA;
         current->tile_data[c] = (uint8_t*)align_get_bits(rw);
         skip_bits_long(rw, 8 * comp_size);
 #else
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".