| Message ID | 20221118210918.3169-4-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 0871cb9499242cb323c245599f3e7e763806e85b |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avcodec/tiff: Ignore tile_count | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/configure_loongarch64 | warning | Failed to run configure |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Fri, Nov 18, 2022 at 10:09:18PM +0100, Michael Niedermayer wrote: > Fixes: Timeout > Fixes: 52695/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQC_fuzzer-4882310386548736 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/vqcdec.c | 14 ++++++++++---- > 1 file changed, 10 insertions(+), 4 deletions(-) > > diff --git a/libavcodec/vqcdec.c b/libavcodec/vqcdec.c > index 5d1a03158c..18cd99462e 100644 > --- a/libavcodec/vqcdec.c > +++ b/libavcodec/vqcdec.c > @@ -137,7 +137,7 @@ static void seed_codebooks(VqcContext * s, const int * seed) > } > } > > -static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, int width, int height) > +static int decode_vectors(VqcContext * s, const uint8_t * buf, int size, int width, int height) > { > GetBitContext gb; > uint8_t * vectors = s->vectors; > @@ -155,9 +155,11 @@ static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, int wi > *dst++ = get_bits(&gb, 8); > > while (show_bits(&gb, 2) != 2) { > - > if (dst >= vectors_end - 1) > - return; > + return 0; > + > + if (get_bits_left(&gb) < 4) > + return AVERROR_INVALIDDATA; > > if (!show_bits(&gb, 4)) { > *dst++ = 0; > @@ -182,6 +184,8 @@ static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, int wi > skip_bits(&gb, 2); > vectors += 32; > } > + > + return 0; > } > > static void load_coeffs(VqcContext * s, const uint8_t * v, int width, int coeff_width) > @@ -392,7 +396,9 @@ static int vqc_decode_frame(AVCodecContext *avctx, AVFrame * rframe, > avpriv_request_sample(avctx, "gamma=0x%x, contrast=0x%x\n", gamma, contrast); > > seed_codebooks(s, seed); > - decode_vectors(s, buf + 7, avpkt->size - 7, avctx->width, avctx->height); > + ret = decode_vectors(s, buf + 7, avpkt->size - 7, avctx->width, avctx->height); > + if (ret < 0) > + return ret; > decode_frame(s, avctx->width, avctx->height); please apply -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
On Sat, Nov 19, 2022 at 10:03:08AM +1100, Peter Ross wrote: > On Fri, Nov 18, 2022 at 10:09:18PM +0100, Michael Niedermayer wrote: > > Fixes: Timeout > > Fixes: 52695/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQC_fuzzer-4882310386548736 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/vqcdec.c | 14 ++++++++++---- > > 1 file changed, 10 insertions(+), 4 deletions(-) > > > > diff --git a/libavcodec/vqcdec.c b/libavcodec/vqcdec.c > > index 5d1a03158c..18cd99462e 100644 > > --- a/libavcodec/vqcdec.c > > +++ b/libavcodec/vqcdec.c > > @@ -137,7 +137,7 @@ static void seed_codebooks(VqcContext * s, const int * seed) > > } > > } > > > > -static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, int width, int height) > > +static int decode_vectors(VqcContext * s, const uint8_t * buf, int size, int width, int height) > > { > > GetBitContext gb; > > uint8_t * vectors = s->vectors; > > @@ -155,9 +155,11 @@ static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, int wi > > *dst++ = get_bits(&gb, 8); > > > > while (show_bits(&gb, 2) != 2) { > > - > > if (dst >= vectors_end - 1) > > - return; > > + return 0; > > + > > + if (get_bits_left(&gb) < 4) > > + return AVERROR_INVALIDDATA; > > > > if (!show_bits(&gb, 4)) { > > *dst++ = 0; > > @@ -182,6 +184,8 @@ static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, int wi > > skip_bits(&gb, 2); > > vectors += 32; > > } > > + > > + return 0; > > } > > > > static void load_coeffs(VqcContext * s, const uint8_t * v, int width, int coeff_width) > > @@ -392,7 +396,9 @@ static int vqc_decode_frame(AVCodecContext *avctx, AVFrame * rframe, > > avpriv_request_sample(avctx, "gamma=0x%x, contrast=0x%x\n", gamma, contrast); > > > > seed_codebooks(s, seed); > > - decode_vectors(s, buf + 7, avpkt->size - 7, avctx->width, avctx->height); > > + ret = decode_vectors(s, buf + 7, avpkt->size - 7, avctx->width, avctx->height); > > + if (ret < 0) > > + return ret; > > decode_frame(s, avctx->width, avctx->height); > > please apply will apply thx [...]
diff --git a/libavcodec/vqcdec.c b/libavcodec/vqcdec.c index 5d1a03158c..18cd99462e 100644 --- a/libavcodec/vqcdec.c +++ b/libavcodec/vqcdec.c @@ -137,7 +137,7 @@ static void seed_codebooks(VqcContext * s, const int * seed) } } -static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, int width, int height) +static int decode_vectors(VqcContext * s, const uint8_t * buf, int size, int width, int height) { GetBitContext gb; uint8_t * vectors = s->vectors; @@ -155,9 +155,11 @@ static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, int wi *dst++ = get_bits(&gb, 8); while (show_bits(&gb, 2) != 2) { - if (dst >= vectors_end - 1) - return; + return 0; + + if (get_bits_left(&gb) < 4) + return AVERROR_INVALIDDATA; if (!show_bits(&gb, 4)) { *dst++ = 0; @@ -182,6 +184,8 @@ static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, int wi skip_bits(&gb, 2); vectors += 32; } + + return 0; } static void load_coeffs(VqcContext * s, const uint8_t * v, int width, int coeff_width) @@ -392,7 +396,9 @@ static int vqc_decode_frame(AVCodecContext *avctx, AVFrame * rframe, avpriv_request_sample(avctx, "gamma=0x%x, contrast=0x%x\n", gamma, contrast); seed_codebooks(s, seed); - decode_vectors(s, buf + 7, avpkt->size - 7, avctx->width, avctx->height); + ret = decode_vectors(s, buf + 7, avpkt->size - 7, avctx->width, avctx->height); + if (ret < 0) + return ret; decode_frame(s, avctx->width, avctx->height); if ((ret = av_frame_ref(rframe, s->frame)) < 0)
Fixes: Timeout Fixes: 52695/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQC_fuzzer-4882310386548736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/vqcdec.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)