From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 8CE1246AD1 for ; Mon, 2 Oct 2023 20:39:45 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 59A6068CADB; Mon, 2 Oct 2023 23:39:43 +0300 (EEST) Received: from EUR05-VI1-obe.outbound.protection.outlook.com (mail-vi1eur05olkn2038.outbound.protection.outlook.com [40.92.90.38]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 7447A68CA5B for ; Mon, 2 Oct 2023 23:39:37 +0300 (EEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ltS7uIgxUoVHnjhqNsc3hiBMjm7cE6vuUFQBCbOkIaM+Nk/na8HDe6a2io+Ws4P5s7sDTFb5h6RQGIP884CfaDl7koqP1Uhg5oev4oyAC9cTRJELMvWxQGx+DSHPiz4qgAJzLMp4yBfBqq0dckZSThlKooxPRcgPmEvAQ1V66+/Kytge8Eoskkw0sNOuTvZ753/2l8p2a8hxv3mBB1o3BO15/j5vW0g2nB6FaGaCsdlqSZDA2EkyYrQqG2GCanMdk5HC1+Fu9XqMYrFX64ZsbZ/ZHsbj7kp2S0T4Ekr2g8CTrANVeZDRRBYQWPmu3a3l0vThuIE4m8VETfRGZHS3Zg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BvTUJr5L3kRjQVD4YkFkNqQgjRzWK3Z/45o+y3CZJYU=; b=k9ahO7Z0Xis6LSnHUm6koGSIfKItR1lOKeUo81ABz3ES+C8y9P2pDcwrn3OwE1Hzo5cpCdAI3K60TkQWdmu8tlYYn07kla5tFtOv9Fr75TUeMH2jQqis3UpkrxN+LLjKWo8TgkArvWvKhWyXOJ+tYjZMl5cnt0qWG8DLhGy2TeAGjgIATD8j7JiTXh3esOBlTCWfu1S/d+2gD7rrt73ZuZZhFRW+BL4Sjl98MllKnuwL2Fbo/jp310sthqd5d81WfZuwHOspDFQLphmNuj/lLzthrX+8mYXppJ8d+wk6+0I8UOvmm9kIa7UcXOqFdZ+6Ebge9/bOCXBAxov8KxGScQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BvTUJr5L3kRjQVD4YkFkNqQgjRzWK3Z/45o+y3CZJYU=; b=pZTZW8zmB0pbySau/IEsCA5Gyvnwvvnk8uyREPZp2vUNtim0TYYgp4VT5Rt4ObnXC/9ljpX9kbIQSRLljv0/n7GVCpSaJk5ofuTJ0eL06DCwcZDnHn6RNOsHwLDBHO/+zkzLHhHAPEUUdqaqLiJXgK7wPvBZLIQWUwqUjEw2fYMmFJWk58rRnDAsJzU/P7NWG3L4iRKn/+3mNi4tryEP87OSxD9NezGBSWYNfGHvazrgOhSLS5pExNcyV6+nq6XJglWWvlUZ0alb3qPk8zGX3tQqsU9tiGibjhJxrhZsNI1UQbkXESlSGV8k/g4wuSLP7P6rADhX3RViHfux370oTg== Received: from AS8P250MB0744.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:541::14) by AM8P250MB0042.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:3d9::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6838.31; Mon, 2 Oct 2023 20:39:35 +0000 Received: from AS8P250MB0744.EURP250.PROD.OUTLOOK.COM ([fe80::5e01:aea5:d3a8:cafa]) by AS8P250MB0744.EURP250.PROD.OUTLOOK.COM ([fe80::5e01:aea5:d3a8:cafa%3]) with mapi id 15.20.6792.026; Mon, 2 Oct 2023 20:39:35 +0000 Message-ID: Date: Mon, 2 Oct 2023 22:40:51 +0200 User-Agent: Mozilla Thunderbird To: ffmpeg-devel@ffmpeg.org References: <20231002202523.148560-1-leo.izen@gmail.com> Content-Language: en-US From: Andreas Rheinhardt In-Reply-To: <20231002202523.148560-1-leo.izen@gmail.com> X-TMN: [wesiTNQCSPXrftPwowoBqHt9ciOqu0+v] X-ClientProxiedBy: ZR2P278CA0074.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:52::8) To AS8P250MB0744.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:541::14) X-Microsoft-Original-Message-ID: <81d43488-9fd4-4ae4-b28d-d88e87da296a@outlook.com> MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P250MB0744:EE_|AM8P250MB0042:EE_ X-MS-Office365-Filtering-Correlation-Id: 328a45d5-07da-433a-75e0-08dbc387b0af X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: rVLTq4XKQdfg3L+lvxYvXXDaWaPBzrQdNChrd1HUsTaadOyxv+WmugIT/Xx3ULqGabjamRxwf4A76uUGL9c8BM4BMX7KISJqfoWSgC+VbWM3vjMQFNSEZQH2W3xirS4ozY+Apc2hP36uAdt7JhJhfP9hZ2nuHgMPhmes620m7KUnC6wfb0uTjejFWjIwvAFfS3X+wbjLlZG8liMfTg9/3w1Ro1WjRSrqqe+Sz7bdvBNMOcm8hhFj2wh4Pq584y0mW/UdRMIQPizzoa3UXsd73ZrESz8iM442EHlrck2qozY+5IpU6yhBsR7ZGFQZ6+iVYT2dSnkRHYNrxkiafO8on8iQ6rU01OpTPNbdv65J9pZwpznuDJ2M+yq+OZZh3ex3p9T8Xa6K64zdve1WM5olx6MQEj7Y2yGSMvVwLSrsZNyb8DG12uOBISFhdWw3eG0DW/ri3RHwyYAaxWfyjj992CiVmD1yVR7cnfxBr06iEssFKdvDq3s1Nb5AlQoplSPtyd6eb2QoU1gAZivEuDhJDhJI2FwHbyK1LcapxMS7gQg4UUOx3KXpZfwg0dLy6SpETlGVepXucGUKKfItggYynLMzsOC1zLShRgdEicrLIgg= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Vkc4MmpoRUlpQ3dNK3pwN25mR0swL3pZc3J2UVlYOTNORjFwNjN6Y29rOHN1?= =?utf-8?B?UVRjQzI5MmVvZG8waGMvTnZJYmhBcVNDSHUycmJmSm94N3NHWGJlbzFreVpU?= =?utf-8?B?RVJxVllLZmttOGlTa1c0aVZjcXJ6Qm1ybnE4OXJQcmhEeEhadFJTZVFqcVhY?= =?utf-8?B?NHAyMlVOa2NhN09SQThWWkRnQzkyRXMwL21RR3lZcFlOTXVxMmMrNDdXajdV?= =?utf-8?B?aW1odGZaZm9tdHFpbkd0ODdYUm9jZzNKanBmb1ZTemEzOXU1cmdxdzJEWi83?= =?utf-8?B?bHluWm9MRGEvKzRGVGNCOWMwMjhkQWQzVXNheEllN0lBclFnNWV3SjdIK2Y5?= =?utf-8?B?SEp3czJ3V3dmN0JpWjI0U3RqNmdJeDhETVpwT05oYVNhVC9PL0thNFdiVHBX?= =?utf-8?B?QlNPeUh2bzgrSXhucUh0SVdvYnNvSGhnN25UczB2RmY3WDZoaElLRFh4R0dT?= =?utf-8?B?dFlyR3VCV24wcm5mcGhDN2p4ZkNPSGtJcXM2aEVScDhVY0JpdzNtdGVYd201?= =?utf-8?B?ZUh5ak1IY1MrM3ppOVYrUzhIVTl4RFMvSm9jd2dDdktvcUpwams0c1B1ZXZx?= =?utf-8?B?YVFkU2I4L3hNVWVZYmNjZkV1d2ZsbkoxRWpLUWQ1dUl3bnVpUWlBclQ4dC9x?= =?utf-8?B?MGtFREZURmdFdWZIdEM3cVlJOGdzWUF6TVJhb2RSaGJDZzJ0Z1JDN2tXSS9r?= =?utf-8?B?TG1ueVhLYmdsZmRYczhNUXpQWGh1M2lPSmpja2dVa2RweUREU2pMdlN6bmwx?= =?utf-8?B?VVNoQmw0aGVpTFlsTTRIU2V1VGhQWEQ4SE1EZ0NWNTh1cWlMMHJId211ZzlY?= =?utf-8?B?TXc3K21wUFhaeWtQekw1WFE4S2grcFh5aW9scTVhQ1VpYmdCTmc2QWhsTlZh?= =?utf-8?B?STZUemw4RTBjUk02NHYzYk01bHM2NFpYaVlpSzFzdXRXNzhtOW5EUlJnSE85?= =?utf-8?B?Q3pnSGhHd2pROFlnMlQyY2FiSFpnaS84MmtFMFJaNys1YWF3MTAzVlowcWFQ?= =?utf-8?B?SysyYS9lMmMzMmk4cFhvaEVJVzE2SEd6Rzh4b0pRY3p6eUlWQ0hwQ0hXNVBQ?= =?utf-8?B?dDVmU0xFb0VxUW13T2xyandPMWNIbmt1a1d1UW1LRyt5V1Q2dDdCWnM5RStz?= =?utf-8?B?M1pyWk5pYnVjNVEvMDVuZU5aQzVKTzErVXB3L3dhYXZEV0ZJQ2kycDh2TVFq?= =?utf-8?B?WG1rMTVnbXJDbXIwM1UxY09GejFoTDJkRWo2MVlEUCszV2JtTU5kbDdoRUp3?= =?utf-8?B?V0M5d1AwNllGQnk0QU9RU3pmSGJpSTlGZ0swdjRCak9HTHRMaXg1eTZRRWxV?= =?utf-8?B?ZXg5RGVUYTNVMUxjTjZoNG05TTE0V1dsbDhGL0lzc0s0WEJGRmhLNFJ4RW84?= =?utf-8?B?ME02ck85WnpTcWE2aGJDODBBL01WZEh4ZmdSdGhkWndyQjBkQnBCd1RiQzNh?= =?utf-8?B?SWsrZXp1VGJOVzVzY0YzaHA2YTgybkp6QTZUc1lDazU1U0lzVmpUL3VwNktJ?= =?utf-8?B?eGM4MlNWZko1QytTVml2ZDVLTXhwUEFjZGJBOHcwS3hINGFYYStIU09qdURo?= =?utf-8?B?MVBIa2J0bXRkTmU5Tm9OdmR2bXhvZVR2Y1FnQ05CTTg2WjRKSFR1eDVYU1dJ?= =?utf-8?B?T0hub1JLUUpzNkIrM2dJOXdvSGVrQlB5QWpKTVAzdEVwdVJLMDlPMG4ybVRt?= =?utf-8?Q?c/EUm5B1puPvBc3BbDoG?= X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 328a45d5-07da-433a-75e0-08dbc387b0af X-MS-Exchange-CrossTenant-AuthSource: AS8P250MB0744.EURP250.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Oct 2023 20:39:35.7702 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM8P250MB0042 Subject: Re: [FFmpeg-devel] [PATCH] avcodec/jpegxl_parser: fix various memory issues X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: Leo Izen: > The spec caps the prefix alphabet size to 32768 (i.e. 1 << 15) so we > need to check for that and reject alphabets that are too large. No, we don't "need to", we can. FFmpeg is not a validator tool. > > Additionally, there's no need to allocate buffers that are as large as > the maximum alphabet size as these aren't stack-allocated, they're heap > allocated and thus can be variable size. > > Added an overflow check as well, which fixes leaking the buffer, and > capping the alphabet size fixes two potential overruns as well. > > Fixes: out of array access > Fixes: 62089/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer- > 5437089094959104.fuzz > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Found-by: Hardik Shah of Vehere (Dawn Treaders team) > Co-authored-by: Michael Niedermayer > Signed-off-by: Leo Izen > --- > libavcodec/jpegxl_parser.c | 23 +++++++++++++++++------ > 1 file changed, 17 insertions(+), 6 deletions(-) > > diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c > index d25a1b6e1d..51af0f4ed1 100644 > --- a/libavcodec/jpegxl_parser.c > +++ b/libavcodec/jpegxl_parser.c > @@ -46,6 +46,8 @@ > #define JXL_FLAG_USE_LF_FRAME 32 > #define JXL_FLAG_SKIP_ADAPTIVE_LF_SMOOTH 128 > > +#define MAX_PREFIX_ALPHABET_SIZE (1u << 15) > + > #define clog1p(x) (ff_log2(x) + !!(x)) > #define unpack_signed(x) (((x) & 1 ? -(x)-1 : (x))/2) > #define div_ceil(x, y) (((x) - 1) / (y) + 1) > @@ -724,16 +726,17 @@ static int read_vlc_prefix(GetBitContext *gb, JXLEntropyDecoder *dec, JXLSymbolD > if (ret < 0) > goto end; > > - buf = av_calloc(1, 262148); // 32768 * 8 + 4 > + buf = av_calloc(1, dist->alphabet_size * (2 * sizeof(int8_t) + sizeof(int16_t) + sizeof(uint32_t)) > + + sizeof(uint32_t)); You can avoid the multiplication by using av_calloc((2 * sizeof(int8_t) + sizeof(int16_t) + sizeof(uint32_t)) + sizeof(uint32_t), dist->alphabet_size). > if (!buf) { > ret = AVERROR(ENOMEM); > goto end; > } > > level2_lens = (int8_t *)buf; > - level2_lens_s = (int8_t *)(buf + 32768); > - level2_syms = (int16_t *)(buf + 65536); > - level2_codecounts = (uint32_t *)(buf + 131072); > + level2_lens_s = (int8_t *)(buf + dist->alphabet_size * sizeof(int8_t)); > + level2_syms = (int16_t *)(buf + dist->alphabet_size * (2 * sizeof(int8_t))); > + level2_codecounts = (uint32_t *)(buf + dist->alphabet_size * (2 * sizeof(int8_t) + sizeof(int16_t))); > > total_code = 0; > for (int i = 0; i < dist->alphabet_size; i++) { > @@ -742,6 +745,10 @@ static int read_vlc_prefix(GetBitContext *gb, JXLEntropyDecoder *dec, JXLSymbolD > int extra = 3 + get_bits(gb, 2); > if (repeat_count_prev) > extra = 4 * (repeat_count_prev - 2) - repeat_count_prev + extra; > + if (i + extra > dist->alphabet_size) { > + ret = AVERROR_INVALIDDATA; > + goto end; > + } > for (int j = 0; j < extra; j++) > level2_lens[i + j] = prev; > total_code += (32768 >> prev) * extra; > @@ -772,8 +779,10 @@ static int read_vlc_prefix(GetBitContext *gb, JXLEntropyDecoder *dec, JXLSymbolD > } > } > > - if (total_code != 32768 && level2_codecounts[0] < dist->alphabet_size - 1) > - return AVERROR_INVALIDDATA; > + if (total_code != 32768 && level2_codecounts[0] < dist->alphabet_size - 1) { > + ret = AVERROR_INVALIDDATA; > + goto end; > + } > > for (int i = 1; i < dist->alphabet_size + 1; i++) > level2_codecounts[i] += level2_codecounts[i - 1]; > @@ -848,6 +857,8 @@ static int read_distribution_bundle(GetBitContext *gb, JXLEntropyDecoder *dec, > if (get_bits1(gb)) { > int n = get_bits(gb, 4); > dist->alphabet_size = 1 + (1 << n) + get_bitsz(gb, n); > + if (dist->alphabet_size > MAX_PREFIX_ALPHABET_SIZE) > + return AVERROR_INVALIDDATA; > } else { > dist->alphabet_size = 1; > } _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".