[FFmpeg-devel] [PATCH 1/2] avcodec/rka: use 64bit for srate_pad computation

[FFmpeg-devel] [PATCH 1/2] avcodec/rka: use 64bit for srate_pad computation

[Michael Niedermayer]

Fixes: left shift of 538976288 by 13 places cannot be represented in type 'int'
Fixes: 56148/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RKA_fuzzer-6257370708967424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/rka.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/rka.c b/libavcodec/rka.c
index 2212e3f930..1e6a48568d 100644
--- a/libavcodec/rka.c
+++ b/libavcodec/rka.c
@@ -207,7 +207,7 @@ static int chctx_init(RKAContext *s, ChContext *c,
     c->bprob[0] = s->bprob[0];
     c->bprob[1] = s->bprob[1];
 
-    c->srate_pad = (sample_rate << 13) / 44100 & 0xFFFFFFFCU;
+    c->srate_pad = ((int64_t)sample_rate << 13) / 44100 & 0xFFFFFFFCU;
     c->pos_idx = 1;
 
     for (int i = 0; i < FF_ARRAY_ELEMS(s->bprob[0]); i++)
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avformat/wavdec: Check that smv block fits in available space

[Michael Niedermayer]

Fixes: OOM
Fixes: 56271/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5290810045497344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/wavdec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index e3f790fcc9..97e69ab2ee 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -730,6 +730,10 @@ smv_retry:
                 goto smv_out;
             }
             size = avio_rl24(s->pb);
+            if (size > wav->smv_block_size) {
+                ret = AVERROR_EOF;
+                goto smv_out;
+            }
             ret  = av_get_packet(s->pb, pkt, size);
             if (ret < 0)
                 goto smv_out;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/rka: use 64bit for srate_pad computation

[Paul B Mahol]

On 3/5/23, Michael Niedermayer <michael@niedermayer.cc> wrote:
> Fixes: left shift of 538976288 by 13 places cannot be represented in type
> 'int'
> Fixes:
> 56148/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RKA_fuzzer-6257370708967424
>

Please make sure that this does not break decoding.

> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/rka.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/rka.c b/libavcodec/rka.c
> index 2212e3f930..1e6a48568d 100644
> --- a/libavcodec/rka.c
> +++ b/libavcodec/rka.c
> @@ -207,7 +207,7 @@ static int chctx_init(RKAContext *s, ChContext *c,
>      c->bprob[0] = s->bprob[0];
>      c->bprob[1] = s->bprob[1];
>
> -    c->srate_pad = (sample_rate << 13) / 44100 & 0xFFFFFFFCU;
> +    c->srate_pad = ((int64_t)sample_rate << 13) / 44100 & 0xFFFFFFFCU;
>      c->pos_idx = 1;
>
>      for (int i = 0; i < FF_ARRAY_ELEMS(s->bprob[0]); i++)
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/rka: use 64bit for srate_pad computation

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1054 bytes --]

On Sun, Mar 05, 2023 at 05:37:09PM +0100, Paul B Mahol wrote:
> On 3/5/23, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > Fixes: left shift of 538976288 by 13 places cannot be represented in type
> > 'int'
> > Fixes:
> > 56148/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RKA_fuzzer-6257370708967424
> >
> 
> Please make sure that this does not break decoding.

how ?

* Testing all rka files on the internet ? 
i cannot

* Reading the specification ?
i failed to find a public specification

* Generating files that have a high enough sample rate with the binary windows
  encoder?
"ERROR: Unsupported format type." even at 88.2k, well below that point

Also if it worked before its dependant on the compiler, its undefined
bahevior.
For files with more normal sample rates like the sample in our archieve
it produces the same output.

Other ideas ?

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

It is what and why we do it that matters, not just one of them.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avformat/wavdec: Check that smv block fits in available space

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 686 bytes --]

On Sun, Mar 05, 2023 at 12:43:46PM +0100, Michael Niedermayer wrote:
> Fixes: OOM
> Fixes: 56271/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5290810045497344
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/wavdec.c | 4 ++++
>  1 file changed, 4 insertions(+)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The bravest are surely those who have the clearest vision
of what is before them, glory and danger alike, and yet
notwithstanding go out to meet it. -- Thucydides

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/rka: use 64bit for srate_pad computation

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1286 bytes --]

On Sun, Mar 05, 2023 at 08:02:20PM +0100, Michael Niedermayer wrote:
> On Sun, Mar 05, 2023 at 05:37:09PM +0100, Paul B Mahol wrote:
> > On 3/5/23, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > > Fixes: left shift of 538976288 by 13 places cannot be represented in type
> > > 'int'
> > > Fixes:
> > > 56148/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RKA_fuzzer-6257370708967424
> > >
> > 
> > Please make sure that this does not break decoding.
> 
> how ?
> 
> * Testing all rka files on the internet ? 
> i cannot
> 
> * Reading the specification ?
> i failed to find a public specification
> 
> * Generating files that have a high enough sample rate with the binary windows
>   encoder?
> "ERROR: Unsupported format type." even at 88.2k, well below that point
> 
> Also if it worked before its dependant on the compiler, its undefined
> bahevior.
> For files with more normal sample rates like the sample in our archieve
> it produces the same output.
> 
> Other ideas ?

is above ok or should more testing be done ?

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

it is not once nor twice but times without number that the same ideas make
their appearance in the world. -- Aristotle

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/rka: use 64bit for srate_pad computation

[Paul B Mahol]

On 5/21/23, Michael Niedermayer <michael@niedermayer.cc> wrote:
> On Sun, Mar 05, 2023 at 08:02:20PM +0100, Michael Niedermayer wrote:
>> On Sun, Mar 05, 2023 at 05:37:09PM +0100, Paul B Mahol wrote:
>> > On 3/5/23, Michael Niedermayer <michael@niedermayer.cc> wrote:
>> > > Fixes: left shift of 538976288 by 13 places cannot be represented in
>> > > type
>> > > 'int'
>> > > Fixes:
>> > > 56148/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RKA_fuzzer-6257370708967424
>> > >
>> >
>> > Please make sure that this does not break decoding.
>>
>> how ?
>>
>> * Testing all rka files on the internet ?
>> i cannot
>>
>> * Reading the specification ?
>> i failed to find a public specification
>>
>> * Generating files that have a high enough sample rate with the binary
>> windows
>>   encoder?
>> "ERROR: Unsupported format type." even at 88.2k, well below that point
>>
>> Also if it worked before its dependant on the compiler, its undefined
>> bahevior.
>> For files with more normal sample rates like the sample in our archieve
>> it produces the same output.
>>
>> Other ideas ?
>
> is above ok or should more testing be done ?

whatever.

> thx
>
> [...]
>
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> it is not once nor twice but times without number that the same ideas make
> their appearance in the world. -- Aristotle
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avcodec/rka: use 64bit for srate_pad computation

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1582 bytes --]

On Sun, May 21, 2023 at 11:05:21PM +0200, Paul B Mahol wrote:
> On 5/21/23, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > On Sun, Mar 05, 2023 at 08:02:20PM +0100, Michael Niedermayer wrote:
> >> On Sun, Mar 05, 2023 at 05:37:09PM +0100, Paul B Mahol wrote:
> >> > On 3/5/23, Michael Niedermayer <michael@niedermayer.cc> wrote:
> >> > > Fixes: left shift of 538976288 by 13 places cannot be represented in
> >> > > type
> >> > > 'int'
> >> > > Fixes:
> >> > > 56148/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RKA_fuzzer-6257370708967424
> >> > >
> >> >
> >> > Please make sure that this does not break decoding.
> >>
> >> how ?
> >>
> >> * Testing all rka files on the internet ?
> >> i cannot
> >>
> >> * Reading the specification ?
> >> i failed to find a public specification
> >>
> >> * Generating files that have a high enough sample rate with the binary
> >> windows
> >>   encoder?
> >> "ERROR: Unsupported format type." even at 88.2k, well below that point
> >>
> >> Also if it worked before its dependant on the compiler, its undefined
> >> bahevior.
> >> For files with more normal sample rates like the sample in our archieve
> >> it produces the same output.
> >>
> >> Other ideas ?
> >
> > is above ok or should more testing be done ?
> 
> whatever.

I assume you are ok with this being applied, so i will apply

thx


[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Asymptotically faster algorithms should always be preferred if you have
asymptotical amounts of data

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".