[FFmpeg-devel] [PATCH 1/5] avformat/hls: Check target_duration

[FFmpeg-devel] [PATCH 1/5] avformat/hls: Check target_duration

[Michael Niedermayer]

Fixes: signed integer overflow: 77777777777777 * 1000000 cannot be represented in type 'long long'
Fixes: 45545/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6438101247983616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/hls.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index cf6ef9dfb6..a58c558ffe 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -819,10 +819,16 @@ static int parse_playlist(HLSContext *c, const char *url,
                                &info);
             new_rendition(c, &info, url);
         } else if (av_strstart(line, "#EXT-X-TARGETDURATION:", &ptr)) {
+            int64_t t;
             ret = ensure_playlist(c, &pls, url);
             if (ret < 0)
                 goto fail;
-            pls->target_duration = strtoll(ptr, NULL, 10) * AV_TIME_BASE;
+            t = strtoll(ptr, NULL, 10);
+            if (t < 0 || t >= INT64_MAX / AV_TIME_BASE) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }
+            pls->target_duration = t * AV_TIME_BASE;
         } else if (av_strstart(line, "#EXT-X-MEDIA-SEQUENCE:", &ptr)) {
             uint64_t seq_no;
             ret = ensure_playlist(c, &pls, url);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/5] avcodec/mlpdec: Use 64bit for channel layout

[Michael Niedermayer]

Fixes: shift exponent 33 is too large for 32-bit type 'int'
Fixes: 45645/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5651350182035456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/mlpdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
index c51e0fbed7..2f5de9254a 100644
--- a/libavcodec/mlpdec.c
+++ b/libavcodec/mlpdec.c
@@ -207,7 +207,7 @@ static enum AVChannel thd_channel_layout_extract_channel(uint64_t channel_layout
         return AV_CHAN_NONE;
 
     for (i = 0; i < FF_ARRAY_ELEMS(thd_channel_order); i++)
-        if (channel_layout & (1 << thd_channel_order[i]) && !index--)
+        if (channel_layout & (1LL << thd_channel_order[i]) && !index--)
             return thd_channel_order[i];
     return AV_CHAN_NONE;
 }
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/5] avcodec/mlpdec: Use 64bit for channel layout

[James Almer]

On 3/20/2022 8:30 PM, Michael Niedermayer wrote:
> Fixes: shift exponent 33 is too large for 32-bit type 'int'
> Fixes: 45645/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5651350182035456
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavcodec/mlpdec.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
> index c51e0fbed7..2f5de9254a 100644
> --- a/libavcodec/mlpdec.c
> +++ b/libavcodec/mlpdec.c
> @@ -207,7 +207,7 @@ static enum AVChannel thd_channel_layout_extract_channel(uint64_t channel_layout
>           return AV_CHAN_NONE;
>   
>       for (i = 0; i < FF_ARRAY_ELEMS(thd_channel_order); i++)
> -        if (channel_layout & (1 << thd_channel_order[i]) && !index--)
> +        if (channel_layout & (1LL << thd_channel_order[i]) && !index--)

1ULL

>               return thd_channel_order[i];
>       return AV_CHAN_NONE;
>   }

LGTM.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/5] avcodec/mlpdec: Use 64bit for channel layout

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1422 bytes --]

On Sun, Mar 20, 2022 at 08:34:32PM -0300, James Almer wrote:
> 
> 
> On 3/20/2022 8:30 PM, Michael Niedermayer wrote:
> > Fixes: shift exponent 33 is too large for 32-bit type 'int'
> > Fixes: 45645/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5651350182035456
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >   libavcodec/mlpdec.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
> > index c51e0fbed7..2f5de9254a 100644
> > --- a/libavcodec/mlpdec.c
> > +++ b/libavcodec/mlpdec.c
> > @@ -207,7 +207,7 @@ static enum AVChannel thd_channel_layout_extract_channel(uint64_t channel_layout
> >           return AV_CHAN_NONE;
> >       for (i = 0; i < FF_ARRAY_ELEMS(thd_channel_order); i++)
> > -        if (channel_layout & (1 << thd_channel_order[i]) && !index--)
> > +        if (channel_layout & (1LL << thd_channel_order[i]) && !index--)
> 
> 1ULL

yes


> 
> >               return thd_channel_order[i];
> >       return AV_CHAN_NONE;
> >   }
> 
> LGTM.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The educated differ from the uneducated as much as the living from the
dead. -- Aristotle 

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/5] avformat/asfdec_f: Check packet_frag_timestamp

[Michael Niedermayer]

Fixes: signed integer overflow: -9223372036854775808 - 4607 cannot be represented in type 'long'
Fixes: 45685/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5280102802391040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/asfdec_f.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index a8f36ed286..b45118e5d1 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -1216,10 +1216,12 @@ static int asf_parse_packet(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt)
             if ((ret = av_new_packet(&asf_st->pkt, asf_st->packet_obj_size)) < 0)
                 return ret;
             asf_st->seq              = asf->packet_seq;
-            if (asf->ts_is_pts) {
-                asf_st->pkt.pts          = asf->packet_frag_timestamp - asf->hdr.preroll;
-            } else
-                asf_st->pkt.dts          = asf->packet_frag_timestamp - asf->hdr.preroll;
+            if (asf->packet_frag_timestamp != AV_NOPTS_VALUE) {
+                if (asf->ts_is_pts) {
+                    asf_st->pkt.pts          = asf->packet_frag_timestamp - asf->hdr.preroll;
+                } else
+                    asf_st->pkt.dts          = asf->packet_frag_timestamp - asf->hdr.preroll;
+            }
             asf_st->pkt.stream_index = asf->stream_index;
             asf_st->pkt.pos          = asf_st->packet_pos = asf->packet_pos;
             asf_st->pkt_clean        = 0;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/5] avformat/asfdec_f: Check packet_frag_timestamp

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 745 bytes --]

On Mon, Mar 21, 2022 at 12:30:54AM +0100, Michael Niedermayer wrote:
> Fixes: signed integer overflow: -9223372036854775808 - 4607 cannot be represented in type 'long'
> Fixes: 45685/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5280102802391040
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/asfdec_f.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you think the mosad wants you dead since a long time then you are either
wrong or dead since a long time.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/5] avformat/bfi: Check offsets better

[Michael Niedermayer]

Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/bfi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavformat/bfi.c b/libavformat/bfi.c
index a42b78b8c0..dcbe21dcae 100644
--- a/libavformat/bfi.c
+++ b/libavformat/bfi.c
@@ -139,12 +139,12 @@ static int bfi_read_packet(AVFormatContext * s, AVPacket * pkt)
         audio_offset    = avio_rl32(pb);
         avio_rl32(pb);
         video_offset    = avio_rl32(pb);
-        audio_size      = video_offset - audio_offset;
-        bfi->video_size = chunk_size - video_offset;
-        if (audio_size < 0 || bfi->video_size < 0) {
+        if (audio_offset < 0 || video_offset < audio_offset || chunk_size < video_offset) {
             av_log(s, AV_LOG_ERROR, "Invalid audio/video offsets or chunk size\n");
             return AVERROR_INVALIDDATA;
         }
+        audio_size      = video_offset - audio_offset;
+        bfi->video_size = chunk_size - video_offset;
 
         //Tossing an audio packet at the audio decoder.
         ret = av_get_packet(pb, pkt, audio_size);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 4/5] avformat/bfi: Check offsets better

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 694 bytes --]

On Mon, Mar 21, 2022 at 12:30:55AM +0100, Michael Niedermayer wrote:
> Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
> Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/bfi.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Why not whip the teacher when the pupil misbehaves? -- Diogenes of Sinope

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 5/5] avformat/aviobuf: Check buf_size in ffio_ensure_seekback()

[Michael Niedermayer]

buffer_size is an int

Fixes: signed integer overflow: 9223372036854775754 + 32767 cannot be represented in type 'long'
Fixes: 45691/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5263458831040512

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/aviobuf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 29d4bd7510..33bc3c2e20 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -1062,6 +1062,9 @@ int ffio_ensure_seekback(AVIOContext *s, int64_t buf_size)
     if (buf_size <= s->buf_end - s->buf_ptr)
         return 0;
 
+    if (buf_size > INT_MAX - max_buffer_size)
+        return AVERROR(EINVAL);
+
     buf_size += max_buffer_size - 1;
 
     if (buf_size + s->buf_ptr - s->buffer <= s->buffer_size || s->seekable || !s->read_packet)
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 5/5] avformat/aviobuf: Check buf_size in ffio_ensure_seekback()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 615 bytes --]

On Mon, Mar 21, 2022 at 12:30:56AM +0100, Michael Niedermayer wrote:
> buffer_size is an int
> 
> Fixes: signed integer overflow: 9223372036854775754 + 32767 cannot be represented in type 'long'
> Fixes: 45691/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5263458831040512
> 
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/aviobuf.c | 3 +++
>  1 file changed, 3 insertions(+)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I have often repented speaking, but never of holding my tongue.
-- Xenocrates

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/5] avformat/hls: Check target_duration

[Steven Liu]

Michael Niedermayer <michael@niedermayer.cc> 于2022年3月21日周一 07:31写道：
>
> Fixes: signed integer overflow: 77777777777777 * 1000000 cannot be represented in type 'long long'
> Fixes: 45545/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6438101247983616
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/hls.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/hls.c b/libavformat/hls.c
> index cf6ef9dfb6..a58c558ffe 100644
> --- a/libavformat/hls.c
> +++ b/libavformat/hls.c
> @@ -819,10 +819,16 @@ static int parse_playlist(HLSContext *c, const char *url,
>                                 &info);
>              new_rendition(c, &info, url);
>          } else if (av_strstart(line, "#EXT-X-TARGETDURATION:", &ptr)) {
> +            int64_t t;
>              ret = ensure_playlist(c, &pls, url);
>              if (ret < 0)
>                  goto fail;
> -            pls->target_duration = strtoll(ptr, NULL, 10) * AV_TIME_BASE;
> +            t = strtoll(ptr, NULL, 10);
> +            if (t < 0 || t >= INT64_MAX / AV_TIME_BASE) {
> +                ret = AVERROR_INVALIDDATA;
> +                goto fail;
> +            }
> +            pls->target_duration = t * AV_TIME_BASE;
>          } else if (av_strstart(line, "#EXT-X-MEDIA-SEQUENCE:", &ptr)) {
>              uint64_t seq_no;
>              ret = ensure_playlist(c, &pls, url);
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".


lgtm

Thanks
Steven
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/5] avformat/hls: Check target_duration

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 2399 bytes --]

On Mon, Mar 21, 2022 at 09:40:46AM +0800, Steven Liu wrote:
> Michael Niedermayer <michael@niedermayer.cc> 于2022年3月21日周一 07:31写道：
> >
> > Fixes: signed integer overflow: 77777777777777 * 1000000 cannot be represented in type 'long long'
> > Fixes: 45545/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6438101247983616
> >
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/hls.c | 8 +++++++-
> >  1 file changed, 7 insertions(+), 1 deletion(-)
> >
> > diff --git a/libavformat/hls.c b/libavformat/hls.c
> > index cf6ef9dfb6..a58c558ffe 100644
> > --- a/libavformat/hls.c
> > +++ b/libavformat/hls.c
> > @@ -819,10 +819,16 @@ static int parse_playlist(HLSContext *c, const char *url,
> >                                 &info);
> >              new_rendition(c, &info, url);
> >          } else if (av_strstart(line, "#EXT-X-TARGETDURATION:", &ptr)) {
> > +            int64_t t;
> >              ret = ensure_playlist(c, &pls, url);
> >              if (ret < 0)
> >                  goto fail;
> > -            pls->target_duration = strtoll(ptr, NULL, 10) * AV_TIME_BASE;
> > +            t = strtoll(ptr, NULL, 10);
> > +            if (t < 0 || t >= INT64_MAX / AV_TIME_BASE) {
> > +                ret = AVERROR_INVALIDDATA;
> > +                goto fail;
> > +            }
> > +            pls->target_duration = t * AV_TIME_BASE;
> >          } else if (av_strstart(line, "#EXT-X-MEDIA-SEQUENCE:", &ptr)) {
> >              uint64_t seq_no;
> >              ret = ensure_playlist(c, &pls, url);
> > --
> > 2.17.1
> >
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel@ffmpeg.org
> > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> >
> > To unsubscribe, visit link above, or email
> > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
> 
> 
> lgtm

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Dictatorship: All citizens are under surveillance, all their steps and
actions recorded, for the politicians to enforce control.
Democracy: All politicians are under surveillance, all their steps and
actions recorded, for the citizens to enforce control.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".