[FFmpeg-devel,4/4] avformat/vividas: Fixes overflow in shift in recover_key()

Submitted by Michael Niedermayer on June 28, 2019, 8:53 p.m.

Details

Message ID 20190628205345.10317-4-michael@niedermayer.cc
State New
Headers show

Commit Message

Michael Niedermayer June 28, 2019, 8:53 p.m.
Fixes: left shift of 133 by 24 places cannot be represented in type 'int'
Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/vividas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Reimar Döffinger June 29, 2019, 3:44 a.m.
On 28.06.2019, at 22:53, Michael Niedermayer <michael@niedermayer.cc> wrote:

> Fixes: left shift of 133 by 24 places cannot be represented in type 'int'
> Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavformat/vividas.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/vividas.c b/libavformat/vividas.c
> index 753328245d..ed2eaea633 100644
> --- a/libavformat/vividas.c
> +++ b/libavformat/vividas.c
> @@ -118,7 +118,7 @@ static unsigned recover_key(unsigned char sample[4], unsigned expected_size)
>     return (sample[0]^plaintext[0])|
>         ((sample[1]^plaintext[1])<<8)|
>         ((sample[2]^plaintext[2])<<16)|
> -        ((sample[3]^plaintext[3])<<24);
> +        ((unsigned)(sample[3]^plaintext[3])<<24);

Shouldn't this just be
return AV_RL32(sample) ^ AV_RL32(plaintext);
?
If so, the code might be worthy of review for more needless overcomplication...
Michael Niedermayer July 13, 2019, 5:54 p.m.
On Sat, Jun 29, 2019 at 05:44:21AM +0200, Reimar Döffinger wrote:
> 
> 
> On 28.06.2019, at 22:53, Michael Niedermayer <michael@niedermayer.cc> wrote:
> 
> > Fixes: left shift of 133 by 24 places cannot be represented in type 'int'
> > Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavformat/vividas.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/vividas.c b/libavformat/vividas.c
> > index 753328245d..ed2eaea633 100644
> > --- a/libavformat/vividas.c
> > +++ b/libavformat/vividas.c
> > @@ -118,7 +118,7 @@ static unsigned recover_key(unsigned char sample[4], unsigned expected_size)
> >     return (sample[0]^plaintext[0])|
> >         ((sample[1]^plaintext[1])<<8)|
> >         ((sample[2]^plaintext[2])<<16)|
> > -        ((sample[3]^plaintext[3])<<24);
> > +        ((unsigned)(sample[3]^plaintext[3])<<24);
> 
> Shouldn't this just be
> return AV_RL32(sample) ^ AV_RL32(plaintext);
> ?

yes, will change it to this

thx


> If so, the code might be worthy of review for more needless overcomplication...
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Patch hide | download patch | download mbox

diff --git a/libavformat/vividas.c b/libavformat/vividas.c
index 753328245d..ed2eaea633 100644
--- a/libavformat/vividas.c
+++ b/libavformat/vividas.c
@@ -118,7 +118,7 @@  static unsigned recover_key(unsigned char sample[4], unsigned expected_size)
     return (sample[0]^plaintext[0])|
         ((sample[1]^plaintext[1])<<8)|
         ((sample[2]^plaintext[2])<<16)|
-        ((sample[3]^plaintext[3])<<24);
+        ((unsigned)(sample[3]^plaintext[3])<<24);
 }
 
 static void xor_block(void *p1, void *p2, unsigned size, int key, unsigned *key_ptr)