Re: [FFmpeg-devel] [PATCH 4/4] avcodec/sanm: Check thet left/top is within the w/h

From: Manuel Lauss <manuel.lauss-at-gmail.com@ffmpeg.org>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: Re: [FFmpeg-devel] [PATCH 4/4] avcodec/sanm: Check thet left/top is within the w/h
Date: Thu, 3 Jul 2025 22:30:13 +0200
Message-ID: <CAOLZvyHk50=nckAOojDCK-VHa3ZHhLnx5ZnMNMVxVOum3UyCQg@mail.gmail.com> (raw)
In-Reply-To: <20250619030432.2977718-4-michael@niedermayer.cc>

On Thu, Jun 19, 2025 at 5:05 AM Michael Niedermayer
<michael@niedermayer.cc> wrote:
>
> Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
> Fixes: out of array access
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/sanm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
> index 02bb78859a8..df248ec3547 100644
> --- a/libavcodec/sanm.c
> +++ b/libavcodec/sanm.c
> @@ -1649,7 +1649,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
>      bytestream2_skip(gb, 2);
>      parm2 = bytestream2_get_le16u(gb);
>
> -    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
> +    if (w < 1 || h < 1 || w > 800 || h > 600 || left >= w || top >= h || left < 0 || top < 0) {
>          av_log(ctx->avctx, AV_LOG_WARNING,
>                 "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
>                 codec, w, h, left, top);

NAK, left and top can be negative, RA1 makes heavy use of this.

Manuel
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".