[FFmpeg-devel] [PATCH 1/2] avformat/utils: keep chapter monotonicity on chapter updates

[FFmpeg-devel] [PATCH 1/2] avformat/utils: keep chapter monotonicity on chapter updates

[Michael Niedermayer]

Updating a chapter with the same id does not break monotonicity
Fixes: Timeout
Fixes: 43727/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4960623367159808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/utils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/utils.c b/libavformat/utils.c
index e643821fc9..940703e87d 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -895,10 +895,11 @@ AVChapter *avpriv_new_chapter(AVFormatContext *s, int64_t id, AVRational time_ba
     if (!s->nb_chapters) {
         si->chapter_ids_monotonic = 1;
     } else if (!si->chapter_ids_monotonic || s->chapters[s->nb_chapters-1]->id >= id) {
-        si->chapter_ids_monotonic = 0;
         for (unsigned i = 0; i < s->nb_chapters; i++)
             if (s->chapters[i]->id == id)
                 chapter = s->chapters[i];
+        if (!chapter)
+            si->chapter_ids_monotonic = 0;
     }
 
     if (!chapter) {
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avcodec/av1dec: Check tile_cols

[Michael Niedermayer]

Fixes: division by zero
Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/av1dec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c
index 62d459cded..581f22a849 100644
--- a/libavcodec/av1dec.c
+++ b/libavcodec/av1dec.c
@@ -394,6 +394,9 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro
     s->tg_start = tile_group->tg_start;
     s->tg_end = tile_group->tg_end;
 
+    if (s->raw_frame_header->tile_cols == 0)
+        return AVERROR_INVALIDDATA;
+
     for (tile_num = tile_group->tg_start; tile_num <= tile_group->tg_end; tile_num++) {
         tile_row = tile_num / s->raw_frame_header->tile_cols;
         tile_col = tile_num % s->raw_frame_header->tile_cols;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/av1dec: Check tile_cols

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 605 bytes --]

On Tue, Feb 01, 2022 at 07:52:39PM +0100, Michael Niedermayer wrote:
> Fixes: division by zero
> Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/av1dec.c | 3 +++
>  1 file changed, 3 insertions(+)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

No snowflake in an avalanche ever feels responsible. -- Voltaire

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/av1dec: Check tile_cols

[James Almer]

On 2/1/2022 3:52 PM, Michael Niedermayer wrote:
> Fixes: division by zero
> Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavcodec/av1dec.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c
> index 62d459cded..581f22a849 100644
> --- a/libavcodec/av1dec.c
> +++ b/libavcodec/av1dec.c
> @@ -394,6 +394,9 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro
>       s->tg_start = tile_group->tg_start;
>       s->tg_end = tile_group->tg_end;
>   
> +    if (s->raw_frame_header->tile_cols == 0)

This should not happen. CBS should have returned an error instead or 
setting tile_cols to 0.
The bug should probably be fixed there.

> +        return AVERROR_INVALIDDATA;
> +
>       for (tile_num = tile_group->tg_start; tile_num <= tile_group->tg_end; tile_num++) {
>           tile_row = tile_num / s->raw_frame_header->tile_cols;
>           tile_col = tile_num % s->raw_frame_header->tile_cols;
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/av1dec: Check tile_cols

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 2389 bytes --]

On Mon, Mar 21, 2022 at 06:03:12PM -0300, James Almer wrote:
> On 2/1/2022 3:52 PM, Michael Niedermayer wrote:
> > Fixes: division by zero
> > Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >   libavcodec/av1dec.c | 3 +++
> >   1 file changed, 3 insertions(+)
> > 
> > diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c
> > index 62d459cded..581f22a849 100644
> > --- a/libavcodec/av1dec.c
> > +++ b/libavcodec/av1dec.c
> > @@ -394,6 +394,9 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro
> >       s->tg_start = tile_group->tg_start;
> >       s->tg_end = tile_group->tg_end;
> > +    if (s->raw_frame_header->tile_cols == 0)
> 
> This should not happen. CBS should have returned an error instead or setting
> tile_cols to 0.
> The bug should probably be fixed there.

I didnt see your mail in time :(
If you want, i can revert it?

The issue seems that cbs av1 and av1dec disagree on how they handle
redundant frames.
I can "fix" it by 
--- a/libavcodec/av1dec.c
+++ b/libavcodec/av1dec.c
@@ -1066,8 +1066,8 @@ static int av1_decode_frame(AVCodecContext *avctx, void *frame,
             }
             break;
         case AV1_OBU_REDUNDANT_FRAME_HEADER:
-            if (s->raw_frame_header)
-                break;
+            // Unsupported
+            break;
         // fall-through
         case AV1_OBU_FRAME:
         case AV1_OBU_FRAME_HEADER:
         
cbs leaves tile_cols untouched (and 0) for the redundant frame
         
I didnt really look further, this probably should be looked at by someone
who knows the av1dec/cbs code better. I can provide the sample file
if someone wants to or also test any suggested fixes
         
I think this split logic where cbs and the decoder have to be kept in
sync is a bit fragile. Or at least it looks fragile

Thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you fake or manipulate statistics in a paper in physics you will never
get a job again.
If you fake or manipulate statistics in a paper in medicin you will get
a job for life at the pharma industry.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avformat/utils: keep chapter monotonicity on chapter updates

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 704 bytes --]

On Tue, Feb 01, 2022 at 07:52:38PM +0100, Michael Niedermayer wrote:
> Updating a chapter with the same id does not break monotonicity
> Fixes: Timeout
> Fixes: 43727/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4960623367159808
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/utils.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The educated differ from the uneducated as much as the living from the
dead. -- Aristotle 

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".