| Message ID | 20210215203123.10676-1-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel] avformat/vividas: Use signed n in read_sb_block() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
Quoting Michael Niedermayer (2021-02-15 21:31:23) > Fixes: OOM > Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/vividas.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavformat/vividas.c b/libavformat/vividas.c > index d745770dc4..b172a48b29 100644 > --- a/libavformat/vividas.c > +++ b/libavformat/vividas.c > @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size, > uint8_t *buf; > uint8_t ibuf[8], sbuf[8]; > uint32_t k2; > - unsigned n; > + int n; > Why would that be better, when it's assigned a uint32_t?
On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote: > Quoting Michael Niedermayer (2021-02-15 21:31:23) > > Fixes: OOM > > Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/vividas.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavformat/vividas.c b/libavformat/vividas.c > > index d745770dc4..b172a48b29 100644 > > --- a/libavformat/vividas.c > > +++ b/libavformat/vividas.c > > @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size, > > uint8_t *buf; > > uint8_t ibuf[8], sbuf[8]; > > uint32_t k2; > > - unsigned n; > > + int n; > > > > Why would that be better, when it's assigned a uint32_t? one (maybe not the only one) issue is if (avio_read(src, buf+8, n) < n) { avio_read() returns int and has a int size so this will not work at all with a unsigned int, not only will it not read more than INT_MAX it also when it fails with an error fail to treat it as an error do you prefer a diferent solution ? thx [...]
Michael Niedermayer: > On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote: >> Quoting Michael Niedermayer (2021-02-15 21:31:23) >>> Fixes: OOM >>> Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688 >>> >>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg >>> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> >>> --- >>> libavformat/vividas.c | 2 +- >>> 1 file changed, 1 insertion(+), 1 deletion(-) >>> >>> diff --git a/libavformat/vividas.c b/libavformat/vividas.c >>> index d745770dc4..b172a48b29 100644 >>> --- a/libavformat/vividas.c >>> +++ b/libavformat/vividas.c >>> @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size, >>> uint8_t *buf; >>> uint8_t ibuf[8], sbuf[8]; >>> uint32_t k2; >>> - unsigned n; >>> + int n; >>> >> >> Why would that be better, when it's assigned a uint32_t? > > one (maybe not the only one) issue is > if (avio_read(src, buf+8, n) < n) { > > avio_read() returns int and has a int size > so this will not work at all with a unsigned int, not only will it not read > more than INT_MAX it also when it fails with an error fail to treat it as > an error > > do you prefer a diferent solution ? > ffio_read_size? Or just use != instead of <? Or check for n > INT_MAX before the call? - Andreas
On Thu, Feb 25, 2021 at 09:59:40PM +0100, Andreas Rheinhardt wrote: > Michael Niedermayer: > > On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote: > >> Quoting Michael Niedermayer (2021-02-15 21:31:23) > >>> Fixes: OOM > >>> Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688 > >>> > >>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > >>> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > >>> --- > >>> libavformat/vividas.c | 2 +- > >>> 1 file changed, 1 insertion(+), 1 deletion(-) > >>> > >>> diff --git a/libavformat/vividas.c b/libavformat/vividas.c > >>> index d745770dc4..b172a48b29 100644 > >>> --- a/libavformat/vividas.c > >>> +++ b/libavformat/vividas.c > >>> @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size, > >>> uint8_t *buf; > >>> uint8_t ibuf[8], sbuf[8]; > >>> uint32_t k2; > >>> - unsigned n; > >>> + int n; > >>> > >> > >> Why would that be better, when it's assigned a uint32_t? > > > > one (maybe not the only one) issue is > > if (avio_read(src, buf+8, n) < n) { > > > > avio_read() returns int and has a int size > > so this will not work at all with a unsigned int, not only will it not read > > more than INT_MAX it also when it fails with an error fail to treat it as > > an error > > > > do you prefer a diferent solution ? > > > ffio_read_size? Or just use != instead of <? Or check for n > INT_MAX > before the call? will apply with an != check instead thx [...]
diff --git a/libavformat/vividas.c b/libavformat/vividas.c index d745770dc4..b172a48b29 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size, uint8_t *buf; uint8_t ibuf[8], sbuf[8]; uint32_t k2; - unsigned n; + int n; if (avio_read(src, ibuf, 8) < 8) return NULL;
Fixes: OOM Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/vividas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)