[FFmpeg-devel] [PATCH 1/3] tools/target_dem_fuzzer: add libavformat/demux.h

[FFmpeg-devel] [PATCH 1/3] tools/target_dem_fuzzer: add libavformat/demux.h

[Michael Niedermayer]

needed for FFInputFormat

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 tools/target_dem_fuzzer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/target_dem_fuzzer.c b/tools/target_dem_fuzzer.c
index 76eed9f6a2..fe69eb9be0 100644
--- a/tools/target_dem_fuzzer.c
+++ b/tools/target_dem_fuzzer.c
@@ -23,7 +23,7 @@
 #include "libavcodec/avcodec.h"
 #include "libavcodec/bytestream.h"
 #include "libavformat/avformat.h"
-
+#include "libavformat/demux.h"
 
 typedef struct IOContext {
     int64_t pos;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/3] avcodec/iff: dont add into unused pointers

[Michael Niedermayer]

Fixes: overflowing pointers
Fixes: 66444/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-4812862400823296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/iff.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index faf4e21c42..dcca7018c4 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -1661,7 +1661,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
                     memset(row, 0, avctx->width);
                     for (plane = 0; plane < s->bpp; plane++) {
-                        buf += decode_byterun(s->planebuf, s->planesize, gb);
+                        decode_byterun(s->planebuf, s->planesize, gb);
                         if (avctx->codec_tag == MKTAG('A', 'N', 'I', 'M')) {
                             memcpy(video, s->planebuf, s->planesize);
                             video += s->planesize;
@@ -1674,7 +1674,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
                     memset(s->mask_buf, 0, avctx->width * sizeof(uint32_t));
                     for (plane = 0; plane < s->bpp; plane++) {
-                        buf += decode_byterun(s->planebuf, s->planesize, gb);
+                        decode_byterun(s->planebuf, s->planesize, gb);
                         decodeplane32(s->mask_buf, s->planebuf, s->planesize, plane);
                     }
                     lookup_pal_indicies((uint32_t *)row, s->mask_buf, s->mask_palbuf, avctx->width);
@@ -1685,7 +1685,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
                     memset(s->ham_buf, 0, s->planesize * 8);
                     for (plane = 0; plane < s->bpp; plane++) {
-                        buf += decode_byterun(s->planebuf, s->planesize, gb);
+                        decode_byterun(s->planebuf, s->planesize, gb);
                         if (avctx->codec_tag == MKTAG('A', 'N', 'I', 'M')) {
                             memcpy(video, s->planebuf, s->planesize);
                             video += s->planesize;
@@ -1699,7 +1699,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
                     memset(row, 0, avctx->width << 2);
                     for (plane = 0; plane < s->bpp; plane++) {
-                        buf += decode_byterun(s->planebuf, s->planesize, gb);
+                        decode_byterun(s->planebuf, s->planesize, gb);
                         decodeplane32((uint32_t *)row, s->planebuf, s->planesize, plane);
                     }
                 }
@@ -1708,12 +1708,12 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
             if (avctx->pix_fmt == AV_PIX_FMT_PAL8 || avctx->pix_fmt == AV_PIX_FMT_GRAY8) {
                 for (y = 0; y < avctx->height; y++) {
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
-                    buf += decode_byterun(row, avctx->width, gb);
+                    decode_byterun(row, avctx->width, gb);
                 }
             } else if (s->ham) { // IFF-PBM: HAM to AV_PIX_FMT_BGR32
                 for (y = 0; y < avctx->height; y++) {
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
-                    buf += decode_byterun(s->ham_buf, avctx->width, gb);
+                    decode_byterun(s->ham_buf, avctx->width, gb);
                     decode_ham_plane32((uint32_t *)row, s->ham_buf, s->ham_palbuf, s->planesize);
                 }
             } else
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/3] avcodec/iff: dont add into unused pointers

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 777 bytes --]

On Sat, Mar 16, 2024 at 10:26:35PM +0100, Michael Niedermayer wrote:
> Fixes: overflowing pointers
> Fixes: 66444/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-4812862400823296
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/iff.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you fake or manipulate statistics in a paper in physics you will never
get a job again.
If you fake or manipulate statistics in a paper in medicin you will get
a job for life at the pharma industry.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/3] tools/target_dec_fuzzer: adjust threshold for AV_CODEC_ID_IFF_ILBM

[Michael Niedermayer]

Fixes: timeout
Fixes: 66444/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-4812862400823296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 tools/target_dec_fuzzer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index 84b646b7f4..104219ed5e 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -245,7 +245,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     case AV_CODEC_ID_HEVC:        maxpixels  /= 16384; break;
     case AV_CODEC_ID_HNM4_VIDEO:  maxpixels  /= 128;   break;
     case AV_CODEC_ID_HQ_HQA:      maxpixels  /= 128;   break;
-    case AV_CODEC_ID_IFF_ILBM:    maxpixels  /= 128;   break;
+    case AV_CODEC_ID_IFF_ILBM:    maxpixels  /= 4096;  break;
     case AV_CODEC_ID_INDEO4:      maxpixels  /= 128;   break;
     case AV_CODEC_ID_INTERPLAY_ACM: maxsamples /= 16384;  break;
     case AV_CODEC_ID_JPEG2000:    maxpixels  /= 4096;  break;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/3] tools/target_dem_fuzzer: add libavformat/demux.h

[Andreas Rheinhardt]

Michael Niedermayer:
> needed for FFInputFormat
> 
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  tools/target_dem_fuzzer.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/target_dem_fuzzer.c b/tools/target_dem_fuzzer.c
> index 76eed9f6a2..fe69eb9be0 100644
> --- a/tools/target_dem_fuzzer.c
> +++ b/tools/target_dem_fuzzer.c
> @@ -23,7 +23,7 @@
>  #include "libavcodec/avcodec.h"
>  #include "libavcodec/bytestream.h"
>  #include "libavformat/avformat.h"
> -
> +#include "libavformat/demux.h"
>  
>  typedef struct IOContext {
>      int64_t pos;

LGTM. Sorry for the breakage.

- Andreas

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".