| Message ID | 20200513204215.17163-2-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | b7e5c8f67d82550daacce58fae97e1fe3d3fb9aa |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avcodec/jpeg2000dec: Free packed_headers | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
On Wed, May 13, 2020 at 10:42:15PM +0200, Michael Niedermayer wrote: > This causes indexes into scale_conversion_table to wrap around, alternatively they > could be clipped, the table be enlarged or we can error out. I have not found a document that specifies > what is the correct way to handle this > > Fixes: out of array access > Fixes: 21727/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-5752477891952640.fuzz > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/hcadec.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) If someone has hca files which do not originate from a fuzzer, these would be helpfull to test this Thanks [...]
On Thu, May 14, 2020 at 09:05:23PM +0200, Michael Niedermayer wrote: > On Wed, May 13, 2020 at 10:42:15PM +0200, Michael Niedermayer wrote: > > This causes indexes into scale_conversion_table to wrap around, alternatively they > > could be clipped, the table be enlarged or we can error out. I have not found a document that specifies > > what is the correct way to handle this > > > > Fixes: out of array access > > Fixes: 21727/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-5752477891952640.fuzz > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/hcadec.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > If someone has hca files which do not originate from a fuzzer, these would be > helpfull to test this no reply, so will apply thx [...]
diff --git a/libavcodec/hcadec.c b/libavcodec/hcadec.c index f25d6c39b66..5fa87319d29 100644 --- a/libavcodec/hcadec.c +++ b/libavcodec/hcadec.c @@ -286,8 +286,8 @@ static void reconstruct_hfr(HCAContext *s, ChannelContext *ch, return; for (int i = 0, k = start_band, l = start_band - 1; i < hfr_group_count; i++){ - for (int j = 0; j < bands_per_hfr_group && k < total_band_count; j++, k++, l--){ - ch->imdct_in[k] = scale_conversion_table[ch->hfr_scale[i] - ch->scale_factors[l]] * ch->imdct_in[l]; + for (int j = 0; j < bands_per_hfr_group && k < total_band_count && l >= 0; j++, k++, l--){ + ch->imdct_in[k] = scale_conversion_table[ (ch->hfr_scale[i] - ch->scale_factors[l]) & 63 ] * ch->imdct_in[l]; } }
This causes indexes into scale_conversion_table to wrap around, alternatively they could be clipped, the table be enlarged or we can error out. I have not found a document that specifies what is the correct way to handle this Fixes: out of array access Fixes: 21727/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-5752477891952640.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/hcadec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)