| Message ID | 20200927075551.30377-2-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [FFmpeg-devel,1/3] avcodec/exr: Check xdelta, ydelta | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
Michael Niedermayer: > Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int' > Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/exr.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/exr.c b/libavcodec/exr.c > index c80e8eb5e0..8621a8cfe4 100644 > --- a/libavcodec/exr.c > +++ b/libavcodec/exr.c > @@ -1783,7 +1783,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, > if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0) > return ret; > > - if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8) > + if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8L) Does this have an advantage over dividing by 8? > return AVERROR_INVALIDDATA; > > // check offset table and recreate it if need >
On Sun, Sep 27, 2020 at 10:21:25AM +0200, Andreas Rheinhardt wrote: > Michael Niedermayer: > > Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int' > > Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/exr.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavcodec/exr.c b/libavcodec/exr.c > > index c80e8eb5e0..8621a8cfe4 100644 > > --- a/libavcodec/exr.c > > +++ b/libavcodec/exr.c > > @@ -1783,7 +1783,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, > > if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0) > > return ret; > > > > - if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8) > > + if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8L) > > Does this have an advantage over dividing by 8? probably not anything thats relevant in this case thx [...]
On Mon, Sep 28, 2020 at 04:13:00PM +0200, Michael Niedermayer wrote: > On Sun, Sep 27, 2020 at 10:21:25AM +0200, Andreas Rheinhardt wrote: > > Michael Niedermayer: > > > Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int' > > > Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624 > > > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > > --- > > > libavcodec/exr.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/libavcodec/exr.c b/libavcodec/exr.c > > > index c80e8eb5e0..8621a8cfe4 100644 > > > --- a/libavcodec/exr.c > > > +++ b/libavcodec/exr.c > > > @@ -1783,7 +1783,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, > > > if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0) > > > return ret; > > > > > > - if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8) > > > + if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8L) > > > > Does this have an advantage over dividing by 8? > > probably not anything thats relevant in this case will apply with a division [...]
diff --git a/libavcodec/exr.c b/libavcodec/exr.c index c80e8eb5e0..8621a8cfe4 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -1783,7 +1783,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0) return ret; - if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8) + if (bytestream2_get_bytes_left(&s->gb) < nb_blocks * 8L) return AVERROR_INVALIDDATA; // check offset table and recreate it if need
Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int' Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/exr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)