From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 1D7914954C for ; Sun, 11 Aug 2024 18:05:50 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 1B0D768DA15; Sun, 11 Aug 2024 21:05:48 +0300 (EEST) Received: from mail-lj1-f180.google.com (mail-lj1-f180.google.com [209.85.208.180]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id AB12968D867 for ; Sun, 11 Aug 2024 21:05:41 +0300 (EEST) Received: by mail-lj1-f180.google.com with SMTP id 38308e7fff4ca-2ef2fccca2cso38201291fa.1 for ; Sun, 11 Aug 2024 11:05:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jkqxz-net.20230601.gappssmtp.com; s=20230601; t=1723399541; x=1724004341; darn=ffmpeg.org; h=content-transfer-encoding:in-reply-to:from:references:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=odS9PWR47arMqABZTcP0IMAcjEkgNfDrOEzy5pNn5tw=; b=Yzg/mHD5VcQQ8u/lSwQerrXh7na4zA8kXyUj1eM0eSe6xLgTl92XqctiESwSjAYLxg DRTBhZTTcssh2eKOTKJwptCFk8llXDr4uGCjQfgu7XzRK4cgHjB75RQ0gUW5+HGJNP9X 8yyQ6orlIvgmTfvZB45SKBqVf/WxMhMYFYNcAqe7VWCYmivK/EjkYsXmIbm3PazZF3Dw UcT0BYyYL4MFIh3eTllZT++l9B86gBR3TeuTiIkRhS5gA6wUuiTpkuFWOTx8Erl41C3a TweImJTe3uDmCOsp73gi2EqIpE3CDYEeb804SRK/mIbfqgOd9M7kQpmWAE1dqNvmCC21 THvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723399541; x=1724004341; h=content-transfer-encoding:in-reply-to:from:references:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=odS9PWR47arMqABZTcP0IMAcjEkgNfDrOEzy5pNn5tw=; b=hO65oMyVLqVoQcZ5MuOzRcexhIKgs+g8rmWLNVFzGwheLkQawG+kT026deViiTbTBC CyUaj7tWSTHUMXRc2eLZK3UURBrfsCHtASqIgzTonwNJE3hDFxCrc1UDz+XjUvsfxUo+ Eno23N6Sbpc8AXPf3jL3+sIX7kWINZ5XhO25zibYZMbTpJqj5cV54aGPYeSCi/p5Xdxb QRlypePM7JCymJH9oyh4n4s5U1pjjPwvil4t9Ld6qCkfJmat1deeQy+lNdujQQknS5r+ mFtUlqus9kdYd/i6kbD4NMzwGGRpIp04Uyc/n6Y1uIScVR15lZ8Rm2lMYI409bNaLW/Q V/aA== X-Gm-Message-State: AOJu0YzM860EsP6ekVXRVMqFXn0huempFkCx3gt/BlM5aJnZOPZNjIlp EVzY4Da3v4/V5xkO5AeVkzuGl4LXXW0lJ4eujbc502h/dzKL4mG12mYhpfLN6Loa0x6GXXLbyMc z X-Google-Smtp-Source: AGHT+IFqRXyufX/NfMyfM6dFD4p8ZPQa8OEKf3bqqMHFuki/sks6TQhJuOYq+Fx7Wtk5zQR4P4rPig== X-Received: by 2002:a2e:d11:0:b0:2f1:a8ca:4f78 with SMTP id 38308e7fff4ca-2f1a8ca5094mr45367361fa.35.1723399539960; Sun, 11 Aug 2024 11:05:39 -0700 (PDT) Received: from [192.168.0.15] (cpc92320-cmbg19-2-0-cust955.5-4.cable.virginm.net. [82.13.67.188]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-429c750393asm74326785e9.1.2024.08.11.11.05.39 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 11 Aug 2024 11:05:39 -0700 (PDT) Message-ID: Date: Sun, 11 Aug 2024 19:05:52 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: ffmpeg-devel@ffmpeg.org References: <20240807235333.2148870-1-michael@niedermayer.cc> <20240807235333.2148870-2-michael@niedermayer.cc> From: Mark Thompson In-Reply-To: <20240807235333.2148870-2-michael@niedermayer.cc> Subject: Re: [FFmpeg-devel] [PATCH 2/2] avcodec/cbs_vp9: Try to store fewer than 2 things in the same bit X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On 08/08/2024 00:53, Michael Niedermayer wrote: > Fixes: use of uninitialized value > Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer > --- > libavcodec/cbs_vp9.c | 9 ++++++--- > libavcodec/cbs_vp9.h | 3 +++ > libavcodec/cbs_vp9_syntax_template.c | 6 +++--- > 3 files changed, 12 insertions(+), 6 deletions(-) > > diff --git a/libavcodec/cbs_vp9.c b/libavcodec/cbs_vp9.c > index 816d06da04d..7b8bc9c7985 100644 > --- a/libavcodec/cbs_vp9.c > +++ b/libavcodec/cbs_vp9.c > @@ -541,9 +541,12 @@ static int cbs_vp9_assemble_fragment(CodedBitstreamContext *ctx, > size_len = av_log2(max) / 8 + 1; > av_assert0(size_len <= 4); > > - sfi.superframe_marker = VP9_SUPERFRAME_MARKER; > - sfi.bytes_per_framesize_minus_1 = size_len - 1; > - sfi.frames_in_superframe_minus_1 = frag->nb_units - 1; > + sfi.superframe_marker = > + sfi.superframe_marker_2 = VP9_SUPERFRAME_MARKER; > + sfi.bytes_per_framesize_minus_1 = > + sfi.bytes_per_framesize_minus_1_2= size_len - 1; > + sfi.frames_in_superframe_minus_1 = > + sfi.frames_in_superframe_minus_1_2 = frag->nb_units - 1; > > size = 2; > for (i = 0; i < frag->nb_units; i++) { > diff --git a/libavcodec/cbs_vp9.h b/libavcodec/cbs_vp9.h > index af15eb4bace..428662a8cdb 100644 > --- a/libavcodec/cbs_vp9.h > +++ b/libavcodec/cbs_vp9.h > @@ -174,6 +174,9 @@ typedef struct VP9RawSuperframeIndex { > uint8_t bytes_per_framesize_minus_1; > uint8_t frames_in_superframe_minus_1; > uint32_t frame_sizes[VP9_MAX_FRAMES_IN_SUPERFRAME]; > + uint8_t superframe_marker_2; > + uint8_t bytes_per_framesize_minus_1_2; > + uint8_t frames_in_superframe_minus_1_2; > } VP9RawSuperframeIndex; > > typedef struct VP9RawSuperframe { > diff --git a/libavcodec/cbs_vp9_syntax_template.c b/libavcodec/cbs_vp9_syntax_template.c > index 2f08eccf180..3f542d0c5d5 100644 > --- a/libavcodec/cbs_vp9_syntax_template.c > +++ b/libavcodec/cbs_vp9_syntax_template.c > @@ -421,9 +421,9 @@ static int FUNC(superframe_index)(CodedBitstreamContext *ctx, RWContext *rw, > frame_sizes[i], 1, i); > } > > - f(3, superframe_marker); > - f(2, bytes_per_framesize_minus_1); > - f(3, frames_in_superframe_minus_1); > + f(3, superframe_marker_2); > + f(2, bytes_per_framesize_minus_1_2); > + f(3, frames_in_superframe_minus_1_2); This gets the syntax element names wrong in traces. > > return 0; > } The two instances of the syntax elements must be identical, if they aren't then the file is invalid. The correct fix therefore would be to constrain the second read values to be identical to the first, not to introduce new syntax elements not in the standard to cover the invalid case. Thanks, - Mark _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".