From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 955DD47B6E for ; Fri, 3 Nov 2023 00:09:01 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 5EB5A68CCE7; Fri, 3 Nov 2023 02:08:59 +0200 (EET) Received: from mail-lf1-f51.google.com (mail-lf1-f51.google.com [209.85.167.51]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 76BEB68CC69 for ; Fri, 3 Nov 2023 02:08:52 +0200 (EET) Received: by mail-lf1-f51.google.com with SMTP id 2adb3069b0e04-507a29c7eefso1851436e87.1 for ; Thu, 02 Nov 2023 17:08:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1698970131; x=1699574931; darn=ffmpeg.org; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=WVAWP2uh9iYW1t6tIIRaL9GB5ViveiW8o82QR3Df2ig=; b=l84hm+DbF6UWmzPg7ArRd6BLaPKJYrRIKwmYQDMO+wnFU3RzIyDJWNtQOmTU5NfrGX GrslxXJNEGjLMjZLm9GOO/v0cwC/BTDKviOXfhDfpy725+7opNtFj7parewFt4giPpYV CTf6BOHGpI3qW3Gz6h/hRcCNxSdhzWjLXpyn2LVaHv4e3HwxdxMUR4lwntBXN9ObbgN5 Xo6UeUy/tI6QowqORYJWK7DQmxktFfxj9zUJbO12maN0NyoYbsI4Y47bEcbySGlQHLNz N6629Qo82A3pxsDxZB9fIM/ihvK7c/x9s+f6KqZJxVGGh3lVFWMCyUL1mVQrB8nbQRUY DHug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1698970131; x=1699574931; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=WVAWP2uh9iYW1t6tIIRaL9GB5ViveiW8o82QR3Df2ig=; b=iqS3G/ORkXyNJKQc6m62AlqVUMBy9TCguj70ekfVLg9SesR3v7esR8lmfCJLuiPuB+ Z6AKICtMZao0vleM8najzSYbbaTILzzYX7u2j8ndnDu+lDQQWdm1pvhY3FqZxKW5yRkr m7aBn+VrS4BtnetOStx0JV2Uw6Ij7KvBFeuuGFa39rRohvKt6blyB10b93AkIGgxUHh8 b4FpmwczVsU+UtP9qfYv1mtatDDWEB6yxXqfUcr2Q3j3epek2inghfCkFMMsBbS/GwnU h0Rzo5vbV2UnTNAQhBk+yLC6CBBBV+9hvZN/tBJvoBRbPCD+hXMbF7slC4WKRzkjvE9L R0dw== X-Gm-Message-State: AOJu0YyorWVx7JG6+SiGe0yTSe+sJtRa3iServV7fDSaVe3mAvpCi0in vU0M/fhjIXubtVl57Imr+VHsjczHwOHnxIXH9dKeK2Sq X-Google-Smtp-Source: AGHT+IFd0JupQHwyTVTjERIZ6RonlRZPcxLsbxfqHA1S+8t9iEcK9eJQ6bn3bwsisBlCKRtyiSbnVIctyWe5dhYOwDk= X-Received: by 2002:a05:6512:489a:b0:502:9fce:b6d4 with SMTP id eq26-20020a056512489a00b005029fceb6d4mr13462642lfb.25.1698970131211; Thu, 02 Nov 2023 17:08:51 -0700 (PDT) MIME-Version: 1.0 References: <20231102235016.3935-1-michael@niedermayer.cc> <20231102235016.3935-3-michael@niedermayer.cc> In-Reply-To: <20231102235016.3935-3-michael@niedermayer.cc> From: Sean McGovern Date: Thu, 2 Nov 2023 20:08:41 -0400 Message-ID: To: FFmpeg development discussions and patches X-Content-Filtered-By: Mailman/MimeDel 2.1.29 Subject: Re: [FFmpeg-devel] [PATCH 3/4] avcodec/flicvideo: consider width in copy loops X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On Thu, Nov 2, 2023, 19:50 Michael Niedermayer wrote: > Fixes: out of array write > Fixes: > 63520/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4876198087622656 > Regression since: c7f8d42c12582b0626ea38117df6c9aea9fcf5b1 (was not posted > to ffmpeg-devel) > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by > : > Michael Niedermayer > --- > libavcodec/flicvideo.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c > index 6ce033ba409..43f3f83bf65 100644 > --- a/libavcodec/flicvideo.c > +++ b/libavcodec/flicvideo.c > @@ -642,7 +642,7 @@ static int flic_decode_frame_8BPP(AVCodecContext > *avctx, > "has incorrect size, skipping chunk\n", chunk_size > - 6); > bytestream2_skip(&g2, chunk_size - 6); > } else { > - for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit, > direction) == 0; > + for (y_ptr = 0; check_pixel_ptr(y_ptr, s->avctx->width, > pixel_limit, direction) == 0; > y_ptr += s->frame->linesize[0]) { > bytestream2_get_buffer(&g2, &pixels[y_ptr], > s->avctx->width); > @@ -949,7 +949,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext > *avctx, > > if (bytestream2_get_bytes_left(&g2) < 2 * s->avctx->width > * s->avctx->height ) > return AVERROR_INVALIDDATA; > - for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit, > direction) == 0; > + for (y_ptr = 0; check_pixel_ptr(y_ptr, 2*s->avctx->width, > pixel_limit, direction) == 0; > y_ptr += s->frame->linesize[0]) { > > pixel_countdown = s->avctx->width; > @@ -1235,7 +1235,7 @@ static int flic_decode_frame_24BPP(AVCodecContext > *avctx, > "bigger than image, skipping chunk\n", chunk_size > - 6); > bytestream2_skip(&g2, chunk_size - 6); > } else { > - for (y_ptr = 0; check_pixel_ptr(y_ptr, 0, pixel_limit, > direction) == 0; > + for (y_ptr = 0; check_pixel_ptr(y_ptr, 3*s->avctx->width, > pixel_limit, direction) == 0; > y_ptr += s->frame->linesize[0]) { > > bytestream2_get_buffer(&g2, pixels + y_ptr, > 3*s->avctx->width); > -- > 2.17.1 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". > On quick inspection this looks OK, but is s->avctx->width guaranteed to be non-zero as well? -- Sean McGovern > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".