[FFmpeg-devel] [PATCH 1/3] avcodec/osq: Fix signed integer overflow in update_stats()

[FFmpeg-devel] [PATCH 1/3] avcodec/osq: Fix signed integer overflow in update_stats()

[Michael Niedermayer]

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736

Note, none of the available osq files uses update_stats(), this change may fix or break
files using coding_mode == 2. The code prior looks wrong though

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/osq.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 1e94a486e9e..14c723ed9c6 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -146,8 +146,8 @@ static void reset_stats(OSQChannel *cb)
 
 static void update_stats(OSQChannel *cb, int val)
 {
-    cb->sum += FFABS(val) - cb->history[cb->pos];
-    cb->history[cb->pos] = FFABS(val);
+    cb->sum += FFABS((int64_t)val) - cb->history[cb->pos];
+    cb->history[cb->pos] = FFABS((int64_t)val);
     cb->pos++;
     cb->count++;
     if (cb->pos >= FF_ARRAY_ELEMS(cb->history))
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/3] avcodec/osq: Add note about update_stats() count

[Michael Niedermayer]

It seems this is basically unused and unfinished code

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/osq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 14c723ed9c6..d3b1d86ee35 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -150,6 +150,8 @@ static void update_stats(OSQChannel *cb, int val)
     cb->history[cb->pos] = FFABS((int64_t)val);
     cb->pos++;
     cb->count++;
+    //NOTE for this to make sense count would need to be limited to FF_ARRAY_ELEMS(cb->history)
+    //Otherwise the average computation later makes no sense
     if (cb->pos >= FF_ARRAY_ELEMS(cb->history))
         cb->pos = 0;
 }
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/3] avcodec/osq: Switch back to av_ceil_log2()

[Michael Niedermayer]

This returns to code closer to prior 56c334d732dbbce43b0c8fc0809ec545b7946832
The prior fixes should limit the sum and avoid the need for double argument log2()

Fixes: Assertion n>=0 && n<=32 failed at libavcodec/get_bits.h:406
Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736

No testcases except fuzzers

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/osq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index d3b1d86ee35..025be667a35 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -165,7 +165,8 @@ static int update_residue_parameter(OSQChannel *cb)
     if (!sum)
         return 0;
     x = sum / cb->count;
-    rice_k = ceil(log2(x));
+    av_assert2(x <= 0x80000000U);
+    rice_k = av_ceil_log2(x);
     if (rice_k >= 30) {
         double f = floor(sum / 1.4426952 + 0.5);
         if (f <= 1) {
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/3] avcodec/osq: Fix signed integer overflow in update_stats()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 915 bytes --]

On Tue, Jun 17, 2025 at 03:17:23AM +0200, Michael Niedermayer wrote:
> Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
> Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736
> 
> Note, none of the available osq files uses update_stats(), this change may fix or break
> files using coding_mode == 2. The code prior looks wrong though
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/osq.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

will apply patchset

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Everything should be made as simple as possible, but not simpler.
-- Albert Einstein

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".