[FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size

[FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size

[Michael Niedermayer]

Fixes: signed integer overflow: 119760682 - -2084600173 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6745781167587328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/vividas.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavformat/vividas.c b/libavformat/vividas.c
index e9954f73ed0..ed4e573df87 100644
--- a/libavformat/vividas.c
+++ b/libavformat/vividas.c
@@ -683,6 +683,7 @@ static int viv_read_packet(AVFormatContext *s,
 
     if (viv->sb_entries[viv->current_sb_entry].flag == 0) {
         uint64_t v_size = ffio_read_varlen(pb);
+        int last = 0, last_start;
 
         if (!viv->num_audio)
             return AVERROR_INVALIDDATA;
@@ -706,12 +707,18 @@ static int viv_read_packet(AVFormatContext *s,
 
             if (i > 0 && start == 0)
                 break;
+            if (start < last)
+                return AVERROR_INVALIDDATA;
 
             viv->n_audio_subpackets = i + 1;
+            last =
             viv->audio_subpackets[i].start = start;
             viv->audio_subpackets[i].pcm_bytes = pcm_bytes;
         }
+        last_start =
         viv->audio_subpackets[viv->n_audio_subpackets].start = (int)(off - avio_tell(pb));
+        if (last_start < last)
+            return AVERROR_INVALIDDATA;
         viv->current_audio_subpacket = 0;
 
     } else {
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/3] avcodec/speexdec: Check channels > 2

[Michael Niedermayer]

More than 2 channels seems unsupported, the code seems to just output empty extra channels

Fixes: Timeout
Fixes: 51569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-5511509165342720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/speexdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c
index 9793d939fcb..08c7e77e7d5 100644
--- a/libavcodec/speexdec.c
+++ b/libavcodec/speexdec.c
@@ -1452,7 +1452,7 @@ static av_cold int speex_decode_init(AVCodecContext *avctx)
             return AVERROR_INVALIDDATA;
 
         s->nb_channels = avctx->ch_layout.nb_channels;
-        if (s->nb_channels <= 0)
+        if (s->nb_channels <= 0 || s->nb_channels > 2)
             return AVERROR_INVALIDDATA;
 
         switch (s->rate) {
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check

[Michael Niedermayer]

Fixes: out of array access
Fixes: 51648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-4644322217164800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/mlpdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
index 635f92895c5..0b0eb759901 100644
--- a/libavcodec/mlpdec.c
+++ b/libavcodec/mlpdec.c
@@ -547,6 +547,9 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
         return AVERROR_PATCHWELCOME;
     }
 
+    if (max_channel + 1 > MAX_CHANNELS || max_channel + 1 < min_channel)
+        return AVERROR_INVALIDDATA;
+
     s->min_channel        = min_channel;
     s->max_channel        = max_channel;
     s->coded_channels     = ((1LL << (max_channel - min_channel + 1)) - 1) << min_channel;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check

[Paul B Mahol]

On 9/30/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> Fixes: out of array access
> Fixes:
> 51648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-4644322217164800
>


Make sure that this "fix"
does not break Mono.thd decoding.
The sample is on trac ticket.

Thanks.

> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/mlpdec.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
> index 635f92895c5..0b0eb759901 100644
> --- a/libavcodec/mlpdec.c
> +++ b/libavcodec/mlpdec.c
> @@ -547,6 +547,9 @@ static int read_restart_header(MLPDecodeContext *m,
> GetBitContext *gbp,
>          return AVERROR_PATCHWELCOME;
>      }
>
> +    if (max_channel + 1 > MAX_CHANNELS || max_channel + 1 < min_channel)
> +        return AVERROR_INVALIDDATA;
> +
>      s->min_channel        = min_channel;
>      s->max_channel        = max_channel;
>      s->coded_channels     = ((1LL << (max_channel - min_channel + 1)) - 1)
> << min_channel;
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 784 bytes --]

On Fri, Sep 30, 2022 at 10:00:57AM +0200, Paul B Mahol wrote:
> On 9/30/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > Fixes: out of array access
> > Fixes:
> > 51648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-4644322217164800
> >
> 
> 
> Make sure that this "fix"
> does not break Mono.thd decoding.
> The sample is on trac ticket.

i have tested Mono.thd before posting the patch

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Dictatorship: All citizens are under surveillance, all their steps and
actions recorded, for the politicians to enforce control.
Democracy: All politicians are under surveillance, all their steps and
actions recorded, for the citizens to enforce control.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/3] avformat/vividas: Check packet size

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 714 bytes --]

On Fri, Sep 30, 2022 at 01:09:25AM +0200, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 119760682 - -2084600173 cannot be represented in type 'int'
> Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6745781167587328
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/vividas.c | 7 +++++++
>  1 file changed, 7 insertions(+)

will apply patchset


[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Republics decline into democracies and democracies degenerate into
despotisms. -- Aristotle

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".