* [FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top
@ 2025-07-31 22:48 Michael Niedermayer
2025-07-31 22:52 ` Michael Niedermayer
2025-08-01 12:50 ` Manuel Lauss
0 siblings, 2 replies; 4+ messages in thread
From: Michael Niedermayer @ 2025-07-31 22:48 UTC (permalink / raw)
To: FFmpeg development discussions and patches; +Cc: Manuel Lauss
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
Fixes: out of array access
CC: Manuel Lauss <manuel.lauss@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/sanm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index 617b977ab70..d345f588463 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
bytestream2_skip(gb, 2);
parm2 = bytestream2_get_le16u(gb);
- if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
+ if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {
av_log(ctx->avctx, AV_LOG_WARNING,
"ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
codec, w, h, left, top);
@@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
}
}
} else {
- if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) {
+ if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) {
/* correct unexpected overly large frames: this happens
* for instance with The Dig's sq1.san video: it has a few
* (all black) 640x480 frames halfway in, while the rest is
@@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
if ((w == ctx->width) && (h == ctx->height)) {
memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size);
} else {
- uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
const uint8_t *src = (uint8_t *)ctx->frm0;
const int cw = FFMIN(w, ctx->width - left);
const int ch = FFMIN(h, ctx->height - top);
if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) {
+ uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
for (int i = 0; i < ch; i++) {
memcpy(dst, src, cw);
dst += ctx->pitch;
--
2.50.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top
2025-07-31 22:48 [FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top Michael Niedermayer
@ 2025-07-31 22:52 ` Michael Niedermayer
2025-08-01 12:50 ` Manuel Lauss
1 sibling, 0 replies; 4+ messages in thread
From: Michael Niedermayer @ 2025-07-31 22:52 UTC (permalink / raw)
To: FFmpeg development discussions and patches; +Cc: Manuel Lauss
[-- Attachment #1.1: Type: text/plain, Size: 3136 bytes --]
Hi
send this to ML, because of ease of "CC:"
On Fri, Aug 01, 2025 at 12:48:32AM +0200, Michael Niedermayer wrote:
> Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
> Fixes: out of array access
>
> CC: Manuel Lauss <manuel.lauss@gmail.com>
manuel, please review / check if this is ok with existing sanm files
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavcodec/sanm.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
> index 617b977ab70..d345f588463 100644
> --- a/libavcodec/sanm.c
> +++ b/libavcodec/sanm.c
> @@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> bytestream2_skip(gb, 2);
> parm2 = bytestream2_get_le16u(gb);
>
> - if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
> + if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {
> av_log(ctx->avctx, AV_LOG_WARNING,
> "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
> codec, w, h, left, top);
> @@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> }
> }
> } else {
> - if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) {
> + if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) {
> /* correct unexpected overly large frames: this happens
> * for instance with The Dig's sq1.san video: it has a few
> * (all black) 640x480 frames halfway in, while the rest is
> @@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> if ((w == ctx->width) && (h == ctx->height)) {
> memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size);
> } else {
> - uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
> const uint8_t *src = (uint8_t *)ctx->frm0;
> const int cw = FFMIN(w, ctx->width - left);
> const int ch = FFMIN(h, ctx->height - top);
> if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) {
> + uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
> for (int i = 0; i < ch; i++) {
> memcpy(dst, src, cw);
> dst += ctx->pitch;
> --
> 2.50.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
Dictatorship naturally arises out of democracy, and the most aggravated
form of tyranny and slavery out of the most extreme liberty. -- Plato
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top
2025-07-31 22:48 [FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top Michael Niedermayer
2025-07-31 22:52 ` Michael Niedermayer
@ 2025-08-01 12:50 ` Manuel Lauss
2025-08-01 14:40 ` Michael Niedermayer
1 sibling, 1 reply; 4+ messages in thread
From: Manuel Lauss @ 2025-08-01 12:50 UTC (permalink / raw)
To: Michael Niedermayer; +Cc: FFmpeg development discussions and patches
On Fri, Aug 1, 2025 at 12:48 AM Michael Niedermayer
<michael@niedermayer.cc> wrote:
>
> Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
> Fixes: out of array access
>
> CC: Manuel Lauss <manuel.lauss@gmail.com>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavcodec/sanm.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
> index 617b977ab70..d345f588463 100644
> --- a/libavcodec/sanm.c
> +++ b/libavcodec/sanm.c
> @@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> bytestream2_skip(gb, 2);
> parm2 = bytestream2_get_le16u(gb);
>
> - if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
> + if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {
OK, makes sense.
> av_log(ctx->avctx, AV_LOG_WARNING,
> "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
> codec, w, h, left, top);
> @@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> }
> }
> } else {
> - if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) {
> + if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) {
OK, does not break anything.
> /* correct unexpected overly large frames: this happens
> * for instance with The Dig's sq1.san video: it has a few
> * (all black) 640x480 frames halfway in, while the rest is
> @@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> if ((w == ctx->width) && (h == ctx->height)) {
> memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size);
> } else {
> - uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
> const uint8_t *src = (uint8_t *)ctx->frm0;
> const int cw = FFMIN(w, ctx->width - left);
> const int ch = FFMIN(h, ctx->height - top);
> if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) {
> + uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
OK
> for (int i = 0; i < ch; i++) {
> memcpy(dst, src, cw);
> dst += ctx->pitch;
Reviewed-by: Manuel Lauss <manuel.lauss@gmail.com>
Thanks!
Manuel
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top
2025-08-01 12:50 ` Manuel Lauss
@ 2025-08-01 14:40 ` Michael Niedermayer
0 siblings, 0 replies; 4+ messages in thread
From: Michael Niedermayer @ 2025-08-01 14:40 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 3055 bytes --]
On Fri, Aug 01, 2025 at 02:50:56PM +0200, Manuel Lauss wrote:
> On Fri, Aug 1, 2025 at 12:48 AM Michael Niedermayer
> <michael@niedermayer.cc> wrote:
> >
> > Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
> > Fixes: out of array access
> >
> > CC: Manuel Lauss <manuel.lauss@gmail.com>
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavcodec/sanm.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
> > index 617b977ab70..d345f588463 100644
> > --- a/libavcodec/sanm.c
> > +++ b/libavcodec/sanm.c
> > @@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> > bytestream2_skip(gb, 2);
> > parm2 = bytestream2_get_le16u(gb);
> >
> > - if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
> > + if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {
>
> OK, makes sense.
>
> > av_log(ctx->avctx, AV_LOG_WARNING,
> > "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
> > codec, w, h, left, top);
> > @@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> > }
> > }
> > } else {
> > - if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) {
> > + if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) {
>
> OK, does not break anything.
>
> > /* correct unexpected overly large frames: this happens
> > * for instance with The Dig's sq1.san video: it has a few
> > * (all black) 640x480 frames halfway in, while the rest is
> > @@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> > if ((w == ctx->width) && (h == ctx->height)) {
> > memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size);
> > } else {
> > - uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
> > const uint8_t *src = (uint8_t *)ctx->frm0;
> > const int cw = FFMIN(w, ctx->width - left);
> > const int ch = FFMIN(h, ctx->height - top);
> > if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) {
> > + uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
>
> OK
>
> > for (int i = 0; i < ch; i++) {
> > memcpy(dst, src, cw);
> > dst += ctx->pitch;
>
>
> Reviewed-by: Manuel Lauss <manuel.lauss@gmail.com>
will apply
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
"Nothing to hide" only works if the folks in power share the values of
you and everyone you know entirely and always will -- Tom Scott
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-08-01 14:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-07-31 22:48 [FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top Michael Niedermayer
2025-07-31 22:52 ` Michael Niedermayer
2025-08-01 12:50 ` Manuel Lauss
2025-08-01 14:40 ` Michael Niedermayer
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git