[FFmpeg-devel] [PATCH 1/2] avcodec/cfhdenc: Clear dwt_tmp

[FFmpeg-devel] [PATCH 1/2] avcodec/cfhdenc: Clear dwt_tmp

[Michael Niedermayer]

This occurs on a 32x32 input

Fixes: use of uninitialized value
Fixes: 70897/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5960860961406976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/cfhdenc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/cfhdenc.c b/libavcodec/cfhdenc.c
index 7084509f6e1..98554187c1b 100644
--- a/libavcodec/cfhdenc.c
+++ b/libavcodec/cfhdenc.c
@@ -285,7 +285,7 @@ static av_cold int cfhd_encode_init(AVCodecContext *avctx)
         s->plane[i].dwt_buf =
             av_calloc(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_buf));
         s->plane[i].dwt_tmp =
-            av_malloc_array(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_tmp));
+            av_calloc(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_tmp));
         if (!s->plane[i].dwt_buf || !s->plane[i].dwt_tmp)
             return AVERROR(ENOMEM);
 
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avcodec/cbs_vp9: Try to store fewer than 2 things in the same bit

[Michael Niedermayer]

Fixes: use of uninitialized value
Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/cbs_vp9.c                 | 9 ++++++---
 libavcodec/cbs_vp9.h                 | 3 +++
 libavcodec/cbs_vp9_syntax_template.c | 6 +++---
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/libavcodec/cbs_vp9.c b/libavcodec/cbs_vp9.c
index 816d06da04d..7b8bc9c7985 100644
--- a/libavcodec/cbs_vp9.c
+++ b/libavcodec/cbs_vp9.c
@@ -541,9 +541,12 @@ static int cbs_vp9_assemble_fragment(CodedBitstreamContext *ctx,
             size_len = av_log2(max) / 8 + 1;
         av_assert0(size_len <= 4);
 
-        sfi.superframe_marker            = VP9_SUPERFRAME_MARKER;
-        sfi.bytes_per_framesize_minus_1  = size_len - 1;
-        sfi.frames_in_superframe_minus_1 = frag->nb_units - 1;
+        sfi.superframe_marker            =
+        sfi.superframe_marker_2          = VP9_SUPERFRAME_MARKER;
+        sfi.bytes_per_framesize_minus_1  =
+        sfi.bytes_per_framesize_minus_1_2= size_len - 1;
+        sfi.frames_in_superframe_minus_1   =
+        sfi.frames_in_superframe_minus_1_2 = frag->nb_units - 1;
 
         size = 2;
         for (i = 0; i < frag->nb_units; i++) {
diff --git a/libavcodec/cbs_vp9.h b/libavcodec/cbs_vp9.h
index af15eb4bace..428662a8cdb 100644
--- a/libavcodec/cbs_vp9.h
+++ b/libavcodec/cbs_vp9.h
@@ -174,6 +174,9 @@ typedef struct VP9RawSuperframeIndex {
     uint8_t bytes_per_framesize_minus_1;
     uint8_t frames_in_superframe_minus_1;
     uint32_t frame_sizes[VP9_MAX_FRAMES_IN_SUPERFRAME];
+    uint8_t superframe_marker_2;
+    uint8_t bytes_per_framesize_minus_1_2;
+    uint8_t frames_in_superframe_minus_1_2;
 } VP9RawSuperframeIndex;
 
 typedef struct VP9RawSuperframe {
diff --git a/libavcodec/cbs_vp9_syntax_template.c b/libavcodec/cbs_vp9_syntax_template.c
index 2f08eccf180..3f542d0c5d5 100644
--- a/libavcodec/cbs_vp9_syntax_template.c
+++ b/libavcodec/cbs_vp9_syntax_template.c
@@ -421,9 +421,9 @@ static int FUNC(superframe_index)(CodedBitstreamContext *ctx, RWContext *rw,
             frame_sizes[i], 1, i);
     }
 
-    f(3, superframe_marker);
-    f(2, bytes_per_framesize_minus_1);
-    f(3, frames_in_superframe_minus_1);
+    f(3, superframe_marker_2);
+    f(2, bytes_per_framesize_minus_1_2);
+    f(3, frames_in_superframe_minus_1_2);
 
     return 0;
 }
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/cbs_vp9: Try to store fewer than 2 things in the same bit

[Mark Thompson]

On 08/08/2024 00:53, Michael Niedermayer wrote:
> Fixes: use of uninitialized value
> Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/cbs_vp9.c                 | 9 ++++++---
>  libavcodec/cbs_vp9.h                 | 3 +++
>  libavcodec/cbs_vp9_syntax_template.c | 6 +++---
>  3 files changed, 12 insertions(+), 6 deletions(-)
> 
> diff --git a/libavcodec/cbs_vp9.c b/libavcodec/cbs_vp9.c
> index 816d06da04d..7b8bc9c7985 100644
> --- a/libavcodec/cbs_vp9.c
> +++ b/libavcodec/cbs_vp9.c
> @@ -541,9 +541,12 @@ static int cbs_vp9_assemble_fragment(CodedBitstreamContext *ctx,
>              size_len = av_log2(max) / 8 + 1;
>          av_assert0(size_len <= 4);
>  
> -        sfi.superframe_marker            = VP9_SUPERFRAME_MARKER;
> -        sfi.bytes_per_framesize_minus_1  = size_len - 1;
> -        sfi.frames_in_superframe_minus_1 = frag->nb_units - 1;
> +        sfi.superframe_marker            =
> +        sfi.superframe_marker_2          = VP9_SUPERFRAME_MARKER;
> +        sfi.bytes_per_framesize_minus_1  =
> +        sfi.bytes_per_framesize_minus_1_2= size_len - 1;
> +        sfi.frames_in_superframe_minus_1   =
> +        sfi.frames_in_superframe_minus_1_2 = frag->nb_units - 1;
>  
>          size = 2;
>          for (i = 0; i < frag->nb_units; i++) {
> diff --git a/libavcodec/cbs_vp9.h b/libavcodec/cbs_vp9.h
> index af15eb4bace..428662a8cdb 100644
> --- a/libavcodec/cbs_vp9.h
> +++ b/libavcodec/cbs_vp9.h
> @@ -174,6 +174,9 @@ typedef struct VP9RawSuperframeIndex {
>      uint8_t bytes_per_framesize_minus_1;
>      uint8_t frames_in_superframe_minus_1;
>      uint32_t frame_sizes[VP9_MAX_FRAMES_IN_SUPERFRAME];
> +    uint8_t superframe_marker_2;
> +    uint8_t bytes_per_framesize_minus_1_2;
> +    uint8_t frames_in_superframe_minus_1_2;
>  } VP9RawSuperframeIndex;
>  
>  typedef struct VP9RawSuperframe {
> diff --git a/libavcodec/cbs_vp9_syntax_template.c b/libavcodec/cbs_vp9_syntax_template.c
> index 2f08eccf180..3f542d0c5d5 100644
> --- a/libavcodec/cbs_vp9_syntax_template.c
> +++ b/libavcodec/cbs_vp9_syntax_template.c
> @@ -421,9 +421,9 @@ static int FUNC(superframe_index)(CodedBitstreamContext *ctx, RWContext *rw,
>              frame_sizes[i], 1, i);
>      }
>  
> -    f(3, superframe_marker);
> -    f(2, bytes_per_framesize_minus_1);
> -    f(3, frames_in_superframe_minus_1);
> +    f(3, superframe_marker_2);
> +    f(2, bytes_per_framesize_minus_1_2);
> +    f(3, frames_in_superframe_minus_1_2);

This gets the syntax element names wrong in traces.

>  
>      return 0;
>  }

The two instances of the syntax elements must be identical, if they aren't then the file is invalid.

The correct fix therefore would be to constrain the second read values to be identical to the first, not to introduce new syntax elements not in the standard to cover the invalid case.

Thanks,

- Mark
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH] cbs_vp9: Ensure that the two superframe_header instances are identical

[Mark Thompson]

Fixes: use of uninitialized value
Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
---
On 11/08/2024 19:05, Mark Thompson wrote:
> The correct fix therefore would be to constrain the second read values to be identical to the first, not to introduce new syntax elements not in the standard to cover the invalid case.

Like this.  (Marked in the same way as your suggested patch based on my assumption that it fixes the problem - please check.)

Trace output is correct in the normal case, and catches the error in the bad one:

[trace_headers @ 0x55a0f5decb40] Packet: 11971 bytes, pts 366, dts 366.
[trace_headers @ 0x55a0f5decb40] Superframe Index
[trace_headers @ 0x55a0f5decb40] 0           superframe_marker                                         110 = 6
[trace_headers @ 0x55a0f5decb40] 3           bytes_per_framesize_minus_1                                01 = 1
[trace_headers @ 0x55a0f5decb40] 5           frames_in_superframe_minus_1                              001 = 1
[trace_headers @ 0x55a0f5decb40] 8           frame_sizes[0]                               1011110000101110 = 11964
[trace_headers @ 0x55a0f5decb40] 24          frame_sizes[1]                               0000000100000000 = 1
[trace_headers @ 0x55a0f5decb40] 40          superframe_marker                                         110 = 6
[trace_headers @ 0x55a0f5decb40] 43          bytes_per_framesize_minus_1                                01 = 1
[trace_headers @ 0x55a0f5decb40] 45          frames_in_superframe_minus_1                              001 = 1

or

[trace_headers @ 0x555af04d7b40] Packet: 11971 bytes, pts 366, dts 366.
[trace_headers @ 0x555af04d7b40] Superframe Index
[trace_headers @ 0x555af04d7b40] 0           superframe_marker                                         110 = 6
[trace_headers @ 0x555af04d7b40] 3           bytes_per_framesize_minus_1                                01 = 1
[trace_headers @ 0x555af04d7b40] 5           frames_in_superframe_minus_1                              001 = 1
[trace_headers @ 0x555af04d7b40] 8           frame_sizes[0]                               1011110000101110 = 11964
[trace_headers @ 0x555af04d7b40] 24          frame_sizes[1]                               0000000100000000 = 1
[trace_headers @ 0x555af04d7b40] 40          superframe_marker                                         110 = 6
[trace_headers @ 0x555af04d7b40] 43          bytes_per_framesize_minus_1                                10 = 2
[trace_headers @ 0x555af04d7b40] bytes_per_framesize_minus_1 out of range: 2, but must be in [1,1].
[vost#0:0/copy @ 0x555af0538400] Error applying bitstream filters to a packet: Invalid data found when processing input

Thanks,

- Mark

 libavcodec/cbs_vp9_syntax_template.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/libavcodec/cbs_vp9_syntax_template.c b/libavcodec/cbs_vp9_syntax_template.c
index 2f08eccf18..5ed3c700dc 100644
--- a/libavcodec/cbs_vp9_syntax_template.c
+++ b/libavcodec/cbs_vp9_syntax_template.c
@@ -421,9 +421,14 @@ static int FUNC(superframe_index)(CodedBitstreamContext *ctx, RWContext *rw,
             frame_sizes[i], 1, i);
     }

-    f(3, superframe_marker);
-    f(2, bytes_per_framesize_minus_1);
-    f(3, frames_in_superframe_minus_1);
+    // Second instance of the superframe header must be identical
+    // to the first.
+    fixed(3,       superframe_marker,
+          current->superframe_marker);
+    fixed(2,       bytes_per_framesize_minus_1,
+          current->bytes_per_framesize_minus_1);
+    fixed(3,       frames_in_superframe_minus_1,
+          current->frames_in_superframe_minus_1);

     return 0;
 }
-- 
2.43.0


_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] cbs_vp9: Ensure that the two superframe_header instances are identical

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 3466 bytes --]

On Sun, Aug 11, 2024 at 07:17:25PM +0100, Mark Thompson wrote:
> Fixes: use of uninitialized value
> Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> ---
> On 11/08/2024 19:05, Mark Thompson wrote:
> > The correct fix therefore would be to constrain the second read values to be identical to the first, not to introduce new syntax elements not in the standard to cover the invalid case.
> 
> Like this.  (Marked in the same way as your suggested patch based on my assumption that it fixes the problem - please check.)
> 
> Trace output is correct in the normal case, and catches the error in the bad one:
> 
> [trace_headers @ 0x55a0f5decb40] Packet: 11971 bytes, pts 366, dts 366.
> [trace_headers @ 0x55a0f5decb40] Superframe Index
> [trace_headers @ 0x55a0f5decb40] 0           superframe_marker                                         110 = 6
> [trace_headers @ 0x55a0f5decb40] 3           bytes_per_framesize_minus_1                                01 = 1
> [trace_headers @ 0x55a0f5decb40] 5           frames_in_superframe_minus_1                              001 = 1
> [trace_headers @ 0x55a0f5decb40] 8           frame_sizes[0]                               1011110000101110 = 11964
> [trace_headers @ 0x55a0f5decb40] 24          frame_sizes[1]                               0000000100000000 = 1
> [trace_headers @ 0x55a0f5decb40] 40          superframe_marker                                         110 = 6
> [trace_headers @ 0x55a0f5decb40] 43          bytes_per_framesize_minus_1                                01 = 1
> [trace_headers @ 0x55a0f5decb40] 45          frames_in_superframe_minus_1                              001 = 1
> 
> or
> 
> [trace_headers @ 0x555af04d7b40] Packet: 11971 bytes, pts 366, dts 366.
> [trace_headers @ 0x555af04d7b40] Superframe Index
> [trace_headers @ 0x555af04d7b40] 0           superframe_marker                                         110 = 6
> [trace_headers @ 0x555af04d7b40] 3           bytes_per_framesize_minus_1                                01 = 1
> [trace_headers @ 0x555af04d7b40] 5           frames_in_superframe_minus_1                              001 = 1
> [trace_headers @ 0x555af04d7b40] 8           frame_sizes[0]                               1011110000101110 = 11964
> [trace_headers @ 0x555af04d7b40] 24          frame_sizes[1]                               0000000100000000 = 1
> [trace_headers @ 0x555af04d7b40] 40          superframe_marker                                         110 = 6
> [trace_headers @ 0x555af04d7b40] 43          bytes_per_framesize_minus_1                                10 = 2
> [trace_headers @ 0x555af04d7b40] bytes_per_framesize_minus_1 out of range: 2, but must be in [1,1].
> [vost#0:0/copy @ 0x555af0538400] Error applying bitstream filters to a packet: Invalid data found when processing input
> 
> Thanks,
> 
> - Mark
> 
>  libavcodec/cbs_vp9_syntax_template.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)

If its intended that this will discard cases where they differ
then your patch is probably ok

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Dictatorship naturally arises out of democracy, and the most aggravated
form of tyranny and slavery out of the most extreme liberty. -- Plato

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".