From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 5EBDF4C334 for ; Thu, 31 Jul 2025 22:52:36 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 7DA0368D037; Fri, 1 Aug 2025 01:52:31 +0300 (EEST) Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [217.70.183.197]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 640DB68CFAE for ; Fri, 1 Aug 2025 01:52:25 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 878D641CFD; Thu, 31 Jul 2025 22:52:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1754002344; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=WpmbPLiF1vxwyaAIzXNm4aE5tClVVlwfpedoOhG58sw=; b=Pbdml3V4++C2kOwoUTYXMG6rne0EpqUSRw3u6rM/Lf6IFOiq1v2IulafZDiS+pP3EwDcDE 8xtWRO1buJaTRYEDiV0saaynfqPhaD1r7cOz/Ac683ls4exHSIIpoVbLRCF9xDoL+euSmj tR4pAKlamOfywsvek+lI5Rsas/D7F8tLU2svD61oLFp6TZ44dLKDDSNsPVB+iYfpkYHjLb QryNg1mSEcwb8Hnzg8uDwQ9bav7x3LuBniBiWGpToqtSMHeW2kl1yxKphocEwveECcWmqK VoAOYN6+YaMmjofKMGXpnDCNK9G9lpYpkH6AE4vI9KwEP2JyNdspeYi+Zzz7+g== Date: Fri, 1 Aug 2025 00:52:23 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20250731225223.GV29660@pb2> References: <20250731224832.2546237-1-michael@niedermayer.cc> MIME-Version: 1.0 In-Reply-To: <20250731224832.2546237-1-michael@niedermayer.cc> X-GND-State: clean X-GND-Score: -90 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdefgddutddvtdeiucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuifetpfffkfdpucggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenfghrlhcuvffnffculddutddmnecujfgurhepfffhvfevuffkfhggtggujgesghdtreertddtvdenucfhrhhomhepofhitghhrggvlhcupfhivgguvghrmhgrhigvrhcuoehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgeqnecuggftrfgrthhtvghrnheplefhkeetheetveevtefftdduueelgedvhfetveefveeggeelgfdugfeludekiefgnecuffhomhgrihhnpehgihhthhhusgdrtghomhdpfhhfmhhpvghgrdhorhhgnecukfhppeeguddrieeirdeihedrudejieenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeeguddrieeirdeihedrudejiedphhgvlhhopehlohgtrghlhhhoshhtpdhmrghilhhfrhhomhepmhhitghhrggvlhesnhhivgguvghrmhgrhigvrhdrtggtpdhnsggprhgtphhtthhopedvpdhrtghpthhtohepfhhfmhhpvghgqdguvghvvghlsehffhhmphgvghdrohhrghdprhgtphhtthhopehmrghnuhgvlhdrlhgruhhsshesghhmrghilhdrtghomh X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Manuel Lauss Content-Type: multipart/mixed; boundary="===============5719550634160284630==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============5719550634160284630== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="1siJQ58SMIELUEf3" Content-Disposition: inline --1siJQ58SMIELUEf3 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi send this to ML, because of ease of "CC:" On Fri, Aug 01, 2025 at 12:48:32AM +0200, Michael Niedermayer wrote: > Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_f= uzzer-5466731806261248 > Fixes: out of array access >=20 > CC: Manuel Lauss manuel, please review / check if this is ok with existing sanm files > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/t= ree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer > --- > libavcodec/sanm.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) >=20 > diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c > index 617b977ab70..d345f588463 100644 > --- a/libavcodec/sanm.c > +++ b/libavcodec/sanm.c > @@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx,= GetByteContext *gb) > bytestream2_skip(gb, 2); > parm2 =3D bytestream2_get_le16u(gb); > =20 > - if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600)= { > + if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 = || left + w <=3D 0 || top + h <=3D 0) { > av_log(ctx->avctx, AV_LOG_WARNING, > "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n", > codec, w, h, left, top); > @@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx,= GetByteContext *gb) > } > } > } else { > - if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc)= { > + if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc= || codec =3D=3D 20)) { > /* correct unexpected overly large frames: this happens > * for instance with The Dig's sq1.san video: it has a few > * (all black) 640x480 frames halfway in, while the rest is > @@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ct= x, GetByteContext *gb) > if ((w =3D=3D ctx->width) && (h =3D=3D ctx->height)) { > memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size); > } else { > - uint8_t *dst =3D (uint8_t *)ctx->fbuf + left + top * ctx->pitch; > const uint8_t *src =3D (uint8_t *)ctx->frm0; > const int cw =3D FFMIN(w, ctx->width - left); > const int ch =3D FFMIN(h, ctx->height - top); > if ((cw > 0) && (ch > 0) && (left >=3D 0) && (top >=3D 0)) { > + uint8_t *dst =3D (uint8_t *)ctx->fbuf + left + top * ctx->pi= tch; > for (int i =3D 0; i < ch; i++) { > memcpy(dst, src, cw); > dst +=3D ctx->pitch; > --=20 > 2.50.1 >=20 > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel >=20 > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". >=20 --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Dictatorship naturally arises out of democracy, and the most aggravated form of tyranny and slavery out of the most extreme liberty. -- Plato --1siJQ58SMIELUEf3 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCaIvzowAKCRBhHseHBAsP q3efAJ44rbkzTw6qBtP/p7ztvJUxEvGNngCfecs55027/QEehD4UB7f5LhSQFDo= =jip3 -----END PGP SIGNATURE----- --1siJQ58SMIELUEf3-- --===============5719550634160284630== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============5719550634160284630==--