| Message ID | 20221225220323.20968-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 902a49c4cd0e3aca4eafa1bae9b09ad9b83ce9c4 |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avcodec/hdrdec: Check for end of input in decompress() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On 12/25/22, Michael Niedermayer <michael@niedermayer.cc> wrote: > Fixes: Timeout > Fixes: > 54386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5053598268784640 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/hdrdec.c | 14 +++++++++++--- > 1 file changed, 11 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c > index 21d3e7f693..998227744b 100644 > --- a/libavcodec/hdrdec.c > +++ b/libavcodec/hdrdec.c > @@ -58,6 +58,8 @@ static int decompress(uint8_t *scanline, int w, > GetByteContext *gb, const uint8_ > int rshift = 0; > > while (w > 0) { > + if (bytestream2_get_bytes_left(gb) < 4) > + return AVERROR_INVALIDDATA; > scanline[0] = bytestream2_get_byte(gb); > scanline[1] = bytestream2_get_byte(gb); > scanline[2] = bytestream2_get_byte(gb); > @@ -143,13 +145,17 @@ static int hdr_decode_frame(AVCodecContext *avctx, > AVFrame *p, > int i; > > if (width < MINELEN || width > MAXELEN) { > - decompress(scanline, width, &gb, scanline); > + ret = decompress(scanline, width, &gb, scanline); > + if (ret < 0) > + return ret; > goto convert; > } > > i = bytestream2_peek_byte(&gb); > if (i != 2) { > - decompress(scanline, width, &gb, scanline); > + ret = decompress(scanline, width, &gb, scanline); > + if (ret < 0) > + return ret; > goto convert; > } > bytestream2_skip(&gb, 1); > @@ -161,7 +167,9 @@ static int hdr_decode_frame(AVCodecContext *avctx, > AVFrame *p, > if (scanline[1] != 2 || scanline[2] & 128) { > scanline[0] = 2; > scanline[3] = i; > - decompress(scanline + 4, width - 1, &gb, scanline); > + ret = decompress(scanline + 4, width - 1, &gb, scanline); > + if (ret < 0) > + return ret; > goto convert; > } > > -- > 2.17.1 > LGTM > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". >
On Mon, Dec 26, 2022 at 03:08:38PM +0100, Paul B Mahol wrote: > On 12/25/22, Michael Niedermayer <michael@niedermayer.cc> wrote: > > Fixes: Timeout > > Fixes: > > 54386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5053598268784640 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/hdrdec.c | 14 +++++++++++--- > > 1 file changed, 11 insertions(+), 3 deletions(-) > > > > diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c > > index 21d3e7f693..998227744b 100644 > > --- a/libavcodec/hdrdec.c > > +++ b/libavcodec/hdrdec.c > > @@ -58,6 +58,8 @@ static int decompress(uint8_t *scanline, int w, > > GetByteContext *gb, const uint8_ > > int rshift = 0; > > > > while (w > 0) { > > + if (bytestream2_get_bytes_left(gb) < 4) > > + return AVERROR_INVALIDDATA; > > scanline[0] = bytestream2_get_byte(gb); > > scanline[1] = bytestream2_get_byte(gb); > > scanline[2] = bytestream2_get_byte(gb); > > @@ -143,13 +145,17 @@ static int hdr_decode_frame(AVCodecContext *avctx, > > AVFrame *p, > > int i; > > > > if (width < MINELEN || width > MAXELEN) { > > - decompress(scanline, width, &gb, scanline); > > + ret = decompress(scanline, width, &gb, scanline); > > + if (ret < 0) > > + return ret; > > goto convert; > > } > > > > i = bytestream2_peek_byte(&gb); > > if (i != 2) { > > - decompress(scanline, width, &gb, scanline); > > + ret = decompress(scanline, width, &gb, scanline); > > + if (ret < 0) > > + return ret; > > goto convert; > > } > > bytestream2_skip(&gb, 1); > > @@ -161,7 +167,9 @@ static int hdr_decode_frame(AVCodecContext *avctx, > > AVFrame *p, > > if (scanline[1] != 2 || scanline[2] & 128) { > > scanline[0] = 2; > > scanline[3] = i; > > - decompress(scanline + 4, width - 1, &gb, scanline); > > + ret = decompress(scanline + 4, width - 1, &gb, scanline); > > + if (ret < 0) > > + return ret; > > goto convert; > > } > > > > -- > > 2.17.1 > > > > LGTM will apply thx [...]
diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c index 21d3e7f693..998227744b 100644 --- a/libavcodec/hdrdec.c +++ b/libavcodec/hdrdec.c @@ -58,6 +58,8 @@ static int decompress(uint8_t *scanline, int w, GetByteContext *gb, const uint8_ int rshift = 0; while (w > 0) { + if (bytestream2_get_bytes_left(gb) < 4) + return AVERROR_INVALIDDATA; scanline[0] = bytestream2_get_byte(gb); scanline[1] = bytestream2_get_byte(gb); scanline[2] = bytestream2_get_byte(gb); @@ -143,13 +145,17 @@ static int hdr_decode_frame(AVCodecContext *avctx, AVFrame *p, int i; if (width < MINELEN || width > MAXELEN) { - decompress(scanline, width, &gb, scanline); + ret = decompress(scanline, width, &gb, scanline); + if (ret < 0) + return ret; goto convert; } i = bytestream2_peek_byte(&gb); if (i != 2) { - decompress(scanline, width, &gb, scanline); + ret = decompress(scanline, width, &gb, scanline); + if (ret < 0) + return ret; goto convert; } bytestream2_skip(&gb, 1); @@ -161,7 +167,9 @@ static int hdr_decode_frame(AVCodecContext *avctx, AVFrame *p, if (scanline[1] != 2 || scanline[2] & 128) { scanline[0] = 2; scanline[3] = i; - decompress(scanline + 4, width - 1, &gb, scanline); + ret = decompress(scanline + 4, width - 1, &gb, scanline); + if (ret < 0) + return ret; goto convert; }
Fixes: Timeout Fixes: 54386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5053598268784640 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/hdrdec.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)