[FFmpeg-devel] [PATCH 1/5] avformat/mov: Check that sample_count is allocated in mov_parse_heif_items()

[FFmpeg-devel] [PATCH 1/5] avformat/mov: Check that sample_count is allocated in mov_parse_heif_items()

[Michael Niedermayer]

Fixes: NULL pointer dereference
Fixes: 416811958/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5425269114732544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 8a094b1ea0a..6e9e3498fb5 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10336,7 +10336,7 @@ static int mov_parse_heif_items(AVFormatContext *s)
         st->codecpar->height = item->height;
 
         err = sanity_checks(s, sc, item->item_id);
-        if (err)
+        if (err || !sc->sample_count)
             return AVERROR_INVALIDDATA;
 
         sc->sample_sizes[0]  = item->extent_length;
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/5] avformat/mov: Check edit_list_dts_entry_end

[Michael Niedermayer]

Fixes: signed integer overflow: 5269246886373498912 + 4035225266123964416 cannot be represented in type 'long'
Fixes: 418319157/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5452638340841472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mov.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 6e9e3498fb5..401fdf70fb4 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4245,6 +4245,10 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
                st->index, edit_list_index, edit_list_media_time, edit_list_duration);
         edit_list_index++;
         edit_list_dts_counter = edit_list_dts_entry_end;
+        if (av_sat_add64(edit_list_dts_entry_end, edit_list_duration) != edit_list_dts_entry_end + (uint64_t)edit_list_duration) {
+            av_log(mov->fc, AV_LOG_ERROR, "edit_list_durations sum exceed 64bit\n");
+            break;
+        }
         edit_list_dts_entry_end += edit_list_duration;
         num_discarded_begin = 0;
         if (!found_non_empty_edit && edit_list_media_time == -1) {
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/5] avcodec/rv60dec: Check sum in read_slice_sizes()

[Michael Niedermayer]

Fixes: signed integer overflow: 2147483647 + 1913651185 cannot be represented in type 'int'
Fixes: 418335931/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-6568264620900352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/rv60dec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c
index 2bbcb1d6209..dbafa7eed02 100644
--- a/libavcodec/rv60dec.c
+++ b/libavcodec/rv60dec.c
@@ -409,6 +409,8 @@ static int read_slice_sizes(RV60Context *s, GetBitContext *gb)
         if (last_size <= 0)
             return AVERROR_INVALIDDATA;
         s->slice[i].size = last_size;
+        if (s->slice[i].size > INT32_MAX - sum)
+            return AVERROR_INVALIDDATA;
         sum += s->slice[i].size;
     }
 
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/5] avcodec/rv60dec: Check sum in read_slice_sizes()

[Peter Ross]

[-- Attachment #1.1: Type: text/plain, Size: 1730 bytes --]

On Sat, Jun 21, 2025 at 11:15:19PM +0200, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 2147483647 + 1913651185 cannot be represented in type 'int'
> Fixes: 418335931/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-6568264620900352
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/rv60dec.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c
> index 2bbcb1d6209..dbafa7eed02 100644
> --- a/libavcodec/rv60dec.c
> +++ b/libavcodec/rv60dec.c
> @@ -409,6 +409,8 @@ static int read_slice_sizes(RV60Context *s, GetBitContext *gb)
>          if (last_size <= 0)
>              return AVERROR_INVALIDDATA;
>          s->slice[i].size = last_size;
> +        if (s->slice[i].size > INT32_MAX - sum)
> +            return AVERROR_INVALIDDATA;
>          sum += s->slice[i].size;

As it turns out, sum is not used for any purpose.
This patch (https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2025-June/345621.html)
drops sum, obviating the need for your patch.

However later on in rv60dec.c, line ~2354, there is a similar summation
of slice sizes. This might need a INT_MAX guard?

      for (int i = 0; i < s->cu_height; i++) {
          if (header_size + ofs >= avpkt->size)
              return AVERROR_INVALIDDATA;
          s->slice[i].data = avpkt->data + header_size + ofs;
          s->slice[i].data_size = FFMIN(s->slice[i].size, avpkt->size - header_size - ofs);
          ofs += s->slice[i].size;
      }


-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/5] avformat/iff: Check nb_channels == 0 in CHNL

[Michael Niedermayer]

Fixes: division by 0
Fixes: 418396712/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6104388018176000
Fixes: 418478219/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4569544410857472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/iff.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/iff.c b/libavformat/iff.c
index 9402be48c98..4ff10beb38a 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -284,7 +284,7 @@ static int parse_dsd_prop(AVFormatContext *s, AVStream *st, uint64_t eof)
                 return AVERROR_INVALIDDATA;
             st->codecpar->ch_layout.order       = AV_CHANNEL_ORDER_UNSPEC;
             st->codecpar->ch_layout.nb_channels = avio_rb16(pb);
-            if (size < 2 + st->codecpar->ch_layout.nb_channels * 4)
+            if (size < 2 + st->codecpar->ch_layout.nb_channels * 4 || !st->codecpar->ch_layout.nb_channels)
                 return AVERROR_INVALIDDATA;
             if (st->codecpar->ch_layout.nb_channels > FF_ARRAY_ELEMS(dsd_layout)) {
                 avpriv_request_sample(s, "channel layout");
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 4/5] avformat/iff: Check nb_channels == 0 in CHNL

[Peter Ross]

[-- Attachment #1.1: Type: text/plain, Size: 1441 bytes --]

On Sat, Jun 21, 2025 at 11:15:20PM +0200, Michael Niedermayer wrote:
> Fixes: division by 0
> Fixes: 418396712/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6104388018176000
> Fixes: 418478219/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4569544410857472
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/iff.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/iff.c b/libavformat/iff.c
> index 9402be48c98..4ff10beb38a 100644
> --- a/libavformat/iff.c
> +++ b/libavformat/iff.c
> @@ -284,7 +284,7 @@ static int parse_dsd_prop(AVFormatContext *s, AVStream *st, uint64_t eof)
>                  return AVERROR_INVALIDDATA;
>              st->codecpar->ch_layout.order       = AV_CHANNEL_ORDER_UNSPEC;
>              st->codecpar->ch_layout.nb_channels = avio_rb16(pb);
> -            if (size < 2 + st->codecpar->ch_layout.nb_channels * 4)
> +            if (size < 2 + st->codecpar->ch_layout.nb_channels * 4 || !st->codecpar->ch_layout.nb_channels)
>                  return AVERROR_INVALIDDATA;
>              if (st->codecpar->ch_layout.nb_channels > FF_ARRAY_ELEMS(dsd_layout)) {
>                  avpriv_request_sample(s, "channel layout");

please apply

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 5/5] avcodec/cbs_apv_syntax_template: Check tile_data_size

[Michael Niedermayer]

Fixes: heap-buffer-overflow
Fixes: 418421333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APV_fuzzer-6592025183191040
Fixes: 418804929/clusterfuzz-testcase-minimized-ffmpeg_BSF_APV_METADATA_fuzzer-5773904646045696
Fixes: 420737045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APV_fuzzer-5535272169439232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/cbs_apv_syntax_template.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/cbs_apv_syntax_template.c b/libavcodec/cbs_apv_syntax_template.c
index fc8a08ff31d..b84565b1076 100644
--- a/libavcodec/cbs_apv_syntax_template.c
+++ b/libavcodec/cbs_apv_syntax_template.c
@@ -236,6 +236,8 @@ static int FUNC(tile)(CodedBitstreamContext *ctx, RWContext *rw,
 #ifdef READ
         int pos = get_bits_count(rw);
         av_assert0(pos % 8 == 0);
+        if (get_bits_left(rw) < 8LL * comp_size)
+            return AVERROR_INVALIDDATA;
         current->tile_data[c] = (uint8_t*)align_get_bits(rw);
         skip_bits_long(rw, 8 * comp_size);
 #else
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".