From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 9A19E4FB7A for ; Sat, 28 Jun 2025 00:27:29 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 8C0DA68E241; Sat, 28 Jun 2025 03:27:25 +0300 (EEST) Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [217.70.183.194]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id D2D1568DF79 for ; Sat, 28 Jun 2025 03:27:18 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 43BA843190 for ; Sat, 28 Jun 2025 00:27:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1751070438; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=hYrL5TceqFyQHgFssw3wp6PfJc6VfNnYP4MSL4RY1GY=; b=nGm0BQx+tIdsD+dElHH4nJfGXMlFKVNPaI+vAkYH2SpnE6g5qH4zoQnlxPHqmC8zDC3MH1 JLTPNr579Ae+ko+Yw3HaRgVyDSWnKyTPebc//JPG/o0n7tEnMENEtFy4+CnMjZDmdD1/K3 7Y2BCfhuySjFm3r1RAueUj1Q4gNVT+6mJ1iSTCnuVOctqtB6Y4+BXhSDykKy7VDJSw7P5w 6QRo7TfE8yoLTL0g4LZcDD+Igd6X84Lpe8S/WPLUb7Siohn+LBjwbPxdsWg1hRPCsI9sBv vRjoLY6rj0ZwmZmqh2wlvvZ6SQ/xcJFLhHoqhzsYLlEUPkAXuxZBfYoPBGorjw== Date: Sat, 28 Jun 2025 02:27:17 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20250628002717.GM29660@pb2> References: <20250621211521.895204-1-michael@niedermayer.cc> <20250621211521.895204-3-michael@niedermayer.cc> MIME-Version: 1.0 In-Reply-To: X-GND-State: clean X-GND-Score: -90 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdefgdeghedtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuifetpfffkfdpucggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenfghrlhcuvffnffculddutddmnecujfgurhepfffhvffukfhfgggtuggjsehgtderredttddvnecuhfhrohhmpefoihgthhgrvghlucfpihgvuggvrhhmrgihvghruceomhhitghhrggvlhesnhhivgguvghrmhgrhigvrhdrtggtqeenucggtffrrghtthgvrhhnpeekgefgjeektedtudeijeeiudethefffeffvdfhvddvvdejuddvgfeigedtieekteenucffohhmrghinhepghhithhhuhgsrdgtohhmpdhffhhmphgvghdrohhrghenucfkphepgedurdeiiedrieejrdduudefnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepgedurdeiiedrieejrdduudefpdhhvghloheplhhotggrlhhhohhsthdpmhgrihhlfhhrohhmpehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgdpnhgspghrtghpthhtohepuddprhgtphhtthhopehffhhmphgvghdquggvvhgvlhesfhhfmhhpvghgrdhorhhg X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH 3/5] avcodec/rv60dec: Check sum in read_slice_sizes() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============2762898652515782670==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============2762898652515782670== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="JCN+0WyC29hztoxm" Content-Disposition: inline --JCN+0WyC29hztoxm Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi Peter On Sun, Jun 22, 2025 at 02:38:46PM +1000, Peter Ross wrote: > On Sat, Jun 21, 2025 at 11:15:19PM +0200, Michael Niedermayer wrote: > > Fixes: signed integer overflow: 2147483647 + 1913651185 cannot be repre= sented in type 'int' > > Fixes: 418335931/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60= _fuzzer-6568264620900352 > >=20 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz= /tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer > > --- > > libavcodec/rv60dec.c | 2 ++ > > 1 file changed, 2 insertions(+) > >=20 > > diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c > > index 2bbcb1d6209..dbafa7eed02 100644 > > --- a/libavcodec/rv60dec.c > > +++ b/libavcodec/rv60dec.c > > @@ -409,6 +409,8 @@ static int read_slice_sizes(RV60Context *s, GetBitC= ontext *gb) > > if (last_size <=3D 0) > > return AVERROR_INVALIDDATA; > > s->slice[i].size =3D last_size; > > + if (s->slice[i].size > INT32_MAX - sum) > > + return AVERROR_INVALIDDATA; > > sum +=3D s->slice[i].size; >=20 > As it turns out, sum is not used for any purpose. > This patch (https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2025-June/345= 621.html) > drops sum, obviating the need for your patch. >=20 > However later on in rv60dec.c, line ~2354, there is a similar summation > of slice sizes. This might need a INT_MAX guard? >=20 > for (int i =3D 0; i < s->cu_height; i++) { > if (header_size + ofs >=3D avpkt->size) > return AVERROR_INVALIDDATA; > s->slice[i].data =3D avpkt->data + header_size + ofs; > s->slice[i].data_size =3D FFMIN(s->slice[i].size, avpkt->size -= header_size - ofs); > ofs +=3D s->slice[i].size; > } teh same testcase also triggers the overflow on the 2nd case if it gets past the first new patch posted thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Those who are too smart to engage in politics are punished by being governed by those who are dumber. -- Plato=20 --JCN+0WyC29hztoxm Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCaF823wAKCRBhHseHBAsP q4TtAJ4uMqF4cG+3qN2B0D1ffn1c7YP+KQCgmJh2/lij8joi2NZIuGij6l5ftyc= =uIN3 -----END PGP SIGNATURE----- --JCN+0WyC29hztoxm-- --===============2762898652515782670== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============2762898652515782670==--