[FFmpeg-devel] [PATCH 1/4] avfilter/framesync: cuddle () closer around =

[FFmpeg-devel] [PATCH 1/4] avfilter/framesync: cuddle () closer around =

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/framesync.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/framesync.c b/libavfilter/framesync.c
index c748262ba6a..6cb4b21fed8 100644
--- a/libavfilter/framesync.c
+++ b/libavfilter/framesync.c
@@ -288,7 +288,7 @@ int ff_framesync_get_frame(FFFrameSync *fs, unsigned in, AVFrame **rframe,
         if (need_copy) {
             if (!(frame = av_frame_clone(frame)))
                 return AVERROR(ENOMEM);
-            if ((ret = ff_inlink_make_frame_writable(fs->parent->inputs[in], &frame) < 0)) {
+            if ((ret = ff_inlink_make_frame_writable(fs->parent->inputs[in], &frame)) < 0) {
                 av_frame_free(&frame);
                 return ret;
             }
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/4] avfilter/buffersink: cuddle () closer around =

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/buffersink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/buffersink.c b/libavfilter/buffersink.c
index 9426ded7ee3..ca2af1bc077 100644
--- a/libavfilter/buffersink.c
+++ b/libavfilter/buffersink.c
@@ -293,7 +293,7 @@ static int asink_query_formats(AVFilterContext *ctx)
         cleanup_redundant_layouts(ctx);
         for (i = 0; i < NB_ITEMS(buf->channel_layouts); i++)
             if ((ret = av_channel_layout_from_mask(&layout, buf->channel_layouts[i])) < 0 ||
-                (ret = ff_add_channel_layout(&layouts, &layout) < 0))
+                (ret = ff_add_channel_layout(&layouts, &layout)) < 0)
                 return ret;
         for (i = 0; i < NB_ITEMS(buf->channel_counts); i++) {
             layout = FF_COUNT2LAYOUT(buf->channel_counts[i]);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/4] avcodec/flicvideo: consider width in copy loops

[Michael Niedermayer]

Fixes: out of array write
Fixes: 63520/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4876198087622656
Regression since: c7f8d42c12582b0626ea38117df6c9aea9fcf5b1 (was not posted to ffmpeg-devel)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/flicvideo.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c
index 6ce033ba409..43f3f83bf65 100644
--- a/libavcodec/flicvideo.c
+++ b/libavcodec/flicvideo.c
@@ -642,7 +642,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                        "has incorrect size, skipping chunk\n", chunk_size - 6);
                 bytestream2_skip(&g2, chunk_size - 6);
             } else {
-                for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit, direction) == 0;
+                for (y_ptr = 0; check_pixel_ptr(y_ptr, s->avctx->width, pixel_limit, direction) == 0;
                      y_ptr += s->frame->linesize[0]) {
                     bytestream2_get_buffer(&g2, &pixels[y_ptr],
                                            s->avctx->width);
@@ -949,7 +949,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
 
                 if (bytestream2_get_bytes_left(&g2) < 2 * s->avctx->width * s->avctx->height )
                     return AVERROR_INVALIDDATA;
-                for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit, direction) == 0;
+                for (y_ptr = 0; check_pixel_ptr(y_ptr, 2*s->avctx->width, pixel_limit, direction) == 0;
                      y_ptr += s->frame->linesize[0]) {
 
                     pixel_countdown = s->avctx->width;
@@ -1235,7 +1235,7 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
                        "bigger than image, skipping chunk\n", chunk_size - 6);
                 bytestream2_skip(&g2, chunk_size - 6);
             } else {
-                for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit, direction) == 0;
+                for (y_ptr = 0; check_pixel_ptr(y_ptr, 3*s->avctx->width, pixel_limit, direction) == 0;
                      y_ptr += s->frame->linesize[0]) {
 
                     bytestream2_get_buffer(&g2, pixels + y_ptr, 3*s->avctx->width);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/4] avformat/lafdec: Check for 0 parameters

[Michael Niedermayer]

Fixes: Timeout
Fixes: 63661/clusterfuzz-testcase-minimized-ffmpeg_dem_LAF_fuzzer-6615365234589696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/lafdec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/lafdec.c b/libavformat/lafdec.c
index 59a59dcfe9c..b867f106aee 100644
--- a/libavformat/lafdec.c
+++ b/libavformat/lafdec.c
@@ -139,7 +139,9 @@ static int laf_read_header(AVFormatContext *ctx)
     s->index = 0;
     s->stored_index = 0;
     s->bpp = bpp;
-    if ((int64_t)bpp * st_count * (int64_t)sample_rate >= INT32_MAX)
+    if ((int64_t)bpp * st_count * (int64_t)sample_rate >= INT32_MAX ||
+        (int64_t)bpp * st_count * (int64_t)sample_rate == 0
+    )
         return AVERROR_INVALIDDATA;
     s->data = av_calloc(st_count * sample_rate, bpp);
     if (!s->data)
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/4] avfilter/buffersink: cuddle () closer around =

[Sean McGovern]

On Thu, Nov 2, 2023, 19:50 Michael Niedermayer <michael@niedermayer.cc>
wrote:

> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavfilter/buffersink.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavfilter/buffersink.c b/libavfilter/buffersink.c
> index 9426ded7ee3..ca2af1bc077 100644
> --- a/libavfilter/buffersink.c
> +++ b/libavfilter/buffersink.c
> @@ -293,7 +293,7 @@ static int asink_query_formats(AVFilterContext *ctx)
>          cleanup_redundant_layouts(ctx);
>          for (i = 0; i < NB_ITEMS(buf->channel_layouts); i++)
>              if ((ret = av_channel_layout_from_mask(&layout,
> buf->channel_layouts[i])) < 0 ||
> -                (ret = ff_add_channel_layout(&layouts, &layout) < 0))
> +                (ret = ff_add_channel_layout(&layouts, &layout)) < 0)
>                  return ret;
>          for (i = 0; i < NB_ITEMS(buf->channel_counts); i++) {
>              layout = FF_COUNT2LAYOUT(buf->channel_counts[i]);
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>

This and 1/2 seem a bit frivolous, but providing they don't violate the
project style guide, LGTM.

-- Sean McGovern

>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avcodec/flicvideo: consider width in copy loops

[Sean McGovern]

On Thu, Nov 2, 2023, 19:50 Michael Niedermayer <michael@niedermayer.cc>
wrote:

> Fixes: out of array write
> Fixes:
> 63520/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4876198087622656
> Regression since: c7f8d42c12582b0626ea38117df6c9aea9fcf5b1 (was not posted
> to ffmpeg-devel)
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/flicvideo.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c
> index 6ce033ba409..43f3f83bf65 100644
> --- a/libavcodec/flicvideo.c
> +++ b/libavcodec/flicvideo.c
> @@ -642,7 +642,7 @@ static int flic_decode_frame_8BPP(AVCodecContext
> *avctx,
>                         "has incorrect size, skipping chunk\n", chunk_size
> - 6);
>                  bytestream2_skip(&g2, chunk_size - 6);
>              } else {
> -                for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit,
> direction) == 0;
> +                for (y_ptr = 0; check_pixel_ptr(y_ptr, s->avctx->width,
> pixel_limit, direction) == 0;
>                       y_ptr += s->frame->linesize[0]) {
>                      bytestream2_get_buffer(&g2, &pixels[y_ptr],
>                                             s->avctx->width);
> @@ -949,7 +949,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext
> *avctx,
>
>                  if (bytestream2_get_bytes_left(&g2) < 2 * s->avctx->width
> * s->avctx->height )
>                      return AVERROR_INVALIDDATA;
> -                for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit,
> direction) == 0;
> +                for (y_ptr = 0; check_pixel_ptr(y_ptr, 2*s->avctx->width,
> pixel_limit, direction) == 0;
>                       y_ptr += s->frame->linesize[0]) {
>
>                      pixel_countdown = s->avctx->width;
> @@ -1235,7 +1235,7 @@ static int flic_decode_frame_24BPP(AVCodecContext
> *avctx,
>                         "bigger than image, skipping chunk\n", chunk_size
> - 6);
>                  bytestream2_skip(&g2, chunk_size - 6);
>              } else {
> -                for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit,
> direction) == 0;
> +                for (y_ptr = 0; check_pixel_ptr(y_ptr, 3*s->avctx->width,
> pixel_limit, direction) == 0;
>                       y_ptr += s->frame->linesize[0]) {
>
>                      bytestream2_get_buffer(&g2, pixels + y_ptr,
> 3*s->avctx->width);
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>

On quick inspection this looks OK,  but is s->avctx->width guaranteed to be
non-zero as well?

-- Sean McGovern

>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 4/4] avformat/lafdec: Check for 0 parameters

[Sean McGovern]

On Thu, Nov 2, 2023, 19:50 Michael Niedermayer <michael@niedermayer.cc>
wrote:

> Fixes: Timeout
> Fixes:
> 63661/clusterfuzz-testcase-minimized-ffmpeg_dem_LAF_fuzzer-6615365234589696
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/lafdec.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/lafdec.c b/libavformat/lafdec.c
> index 59a59dcfe9c..b867f106aee 100644
> --- a/libavformat/lafdec.c
> +++ b/libavformat/lafdec.c
> @@ -139,7 +139,9 @@ static int laf_read_header(AVFormatContext *ctx)
>      s->index = 0;
>      s->stored_index = 0;
>      s->bpp = bpp;
> -    if ((int64_t)bpp * st_count * (int64_t)sample_rate >= INT32_MAX)
> +    if ((int64_t)bpp * st_count * (int64_t)sample_rate >= INT32_MAX ||
> +        (int64_t)bpp * st_count * (int64_t)sample_rate == 0
> +    )
>          return AVERROR_INVALIDDATA;
>      s->data = av_calloc(st_count * sample_rate, bpp);
>      if (!s->data)
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>

This looks OK to me.

-- Sean McGovern

>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avcodec/flicvideo: consider width in copy loops

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 3694 bytes --]

On Thu, Nov 02, 2023 at 08:08:41PM -0400, Sean McGovern wrote:
> On Thu, Nov 2, 2023, 19:50 Michael Niedermayer <michael@niedermayer.cc>
> wrote:
> 
> > Fixes: out of array write
> > Fixes:
> > 63520/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4876198087622656
> > Regression since: c7f8d42c12582b0626ea38117df6c9aea9fcf5b1 (was not posted
> > to ffmpeg-devel)
> >
> > Found-by: continuous fuzzing process
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by
> > <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> > Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/flicvideo.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c
> > index 6ce033ba409..43f3f83bf65 100644
> > --- a/libavcodec/flicvideo.c
> > +++ b/libavcodec/flicvideo.c
> > @@ -642,7 +642,7 @@ static int flic_decode_frame_8BPP(AVCodecContext
> > *avctx,
> >                         "has incorrect size, skipping chunk\n", chunk_size
> > - 6);
> >                  bytestream2_skip(&g2, chunk_size - 6);
> >              } else {
> > -                for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit,
> > direction) == 0;
> > +                for (y_ptr = 0; check_pixel_ptr(y_ptr, s->avctx->width,
> > pixel_limit, direction) == 0;
> >                       y_ptr += s->frame->linesize[0]) {
> >                      bytestream2_get_buffer(&g2, &pixels[y_ptr],
> >                                             s->avctx->width);
> > @@ -949,7 +949,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext
> > *avctx,
> >
> >                  if (bytestream2_get_bytes_left(&g2) < 2 * s->avctx->width
> > * s->avctx->height )
> >                      return AVERROR_INVALIDDATA;
> > -                for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit,
> > direction) == 0;
> > +                for (y_ptr = 0; check_pixel_ptr(y_ptr, 2*s->avctx->width,
> > pixel_limit, direction) == 0;
> >                       y_ptr += s->frame->linesize[0]) {
> >
> >                      pixel_countdown = s->avctx->width;
> > @@ -1235,7 +1235,7 @@ static int flic_decode_frame_24BPP(AVCodecContext
> > *avctx,
> >                         "bigger than image, skipping chunk\n", chunk_size
> > - 6);
> >                  bytestream2_skip(&g2, chunk_size - 6);
> >              } else {
> > -                for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit,
> > direction) == 0;
> > +                for (y_ptr = 0; check_pixel_ptr(y_ptr, 3*s->avctx->width,
> > pixel_limit, direction) == 0;
> >                       y_ptr += s->frame->linesize[0]) {
> >
> >                      bytestream2_get_buffer(&g2, pixels + y_ptr,
> > 3*s->avctx->width);
> > --
> > 2.17.1
> >
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel@ffmpeg.org
> > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> >
> > To unsubscribe, visit link above, or email
> > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
> >
> 
> On quick inspection this looks OK,

will apply patchset (the first 2 with less funny commit messages)


>but is s->avctx->width guaranteed to be
> non-zero as well?

if width somehow manages to be 0 then reget_buffer would fail
so none of this code should be reachable

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The smallest minority on earth is the individual. Those who deny 
individual rights cannot claim to be defenders of minorities. - Ayn Rand

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/4] avfilter/buffersink: cuddle () closer around =

[Nicolas George]

[-- Attachment #1.1: Type: text/plain, Size: 277 bytes --]

Michael Niedermayer (12023-11-03):
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavfilter/buffersink.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Patches 1 and 2 look good to me. Good catch.

Regards,

-- 
  Nicolas George

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".