[FFmpeg-devel,2/6] avformat/vividas: Fixes overflow in shift in recover_key()

Submitted by Michael Niedermayer on July 13, 2019, 8:25 p.m.

Details

Message ID 20190713202506.14871-2-michael@niedermayer.cc
State Accepted
Commit 62d10ec35c3055a153b08f51d844932f19ed66e7
Headers show

Commit Message

Michael Niedermayer July 13, 2019, 8:25 p.m.
Fixes: left shift of 133 by 24 places cannot be represented in type 'int'
Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/vividas.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

Comments

Reimar Döffinger July 14, 2019, 7:28 a.m.
On 13 July 2019 22:25:02 CEST, Michael Niedermayer <michael@niedermayer.cc> wrote:
>Fixes: left shift of 133 by 24 places cannot be represented in type
>'int'
>Fixes:
>15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568
>
>Found-by: continuous fuzzing process
>https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>Suggested-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
>Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>---
> libavformat/vividas.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
>diff --git a/libavformat/vividas.c b/libavformat/vividas.c
>index 350c7aa70a..830e318645 100644
>--- a/libavformat/vividas.c
>+++ b/libavformat/vividas.c
>@@ -115,10 +115,7 @@ static unsigned recover_key(unsigned char
>sample[4], unsigned expected_size)
> 
>     put_v(plaintext+2, expected_size);
> 
>-    return (sample[0]^plaintext[0])|
>-        ((sample[1]^plaintext[1])<<8)|
>-        ((sample[2]^plaintext[2])<<16)|
>-        ((sample[3]^plaintext[3])<<24);
>+    return AV_RL32(sample) ^ AV_RL32(plaintext);
> }
> 
>static void xor_block(void *p1, void *p2, unsigned size, int key,
>unsigned *key_ptr)

Looks good to me.
Michael Niedermayer July 14, 2019, 11:44 a.m.
On Sun, Jul 14, 2019 at 09:28:01AM +0200, Reimar Döffinger wrote:
> On 13 July 2019 22:25:02 CEST, Michael Niedermayer <michael@niedermayer.cc> wrote:
> >Fixes: left shift of 133 by 24 places cannot be represented in type
> >'int'
> >Fixes:
> >15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568
> >
> >Found-by: continuous fuzzing process
> >https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> >Suggested-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
> >Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> >---
> > libavformat/vividas.c | 5 +----
> > 1 file changed, 1 insertion(+), 4 deletions(-)
> >
> >diff --git a/libavformat/vividas.c b/libavformat/vividas.c
> >index 350c7aa70a..830e318645 100644
> >--- a/libavformat/vividas.c
> >+++ b/libavformat/vividas.c
> >@@ -115,10 +115,7 @@ static unsigned recover_key(unsigned char
> >sample[4], unsigned expected_size)
> > 
> >     put_v(plaintext+2, expected_size);
> > 
> >-    return (sample[0]^plaintext[0])|
> >-        ((sample[1]^plaintext[1])<<8)|
> >-        ((sample[2]^plaintext[2])<<16)|
> >-        ((sample[3]^plaintext[3])<<24);
> >+    return AV_RL32(sample) ^ AV_RL32(plaintext);
> > }
> > 
> >static void xor_block(void *p1, void *p2, unsigned size, int key,
> >unsigned *key_ptr)
> 
> Looks good to me.

will apply

thx

[...]

Patch hide | download patch | download mbox

diff --git a/libavformat/vividas.c b/libavformat/vividas.c
index 350c7aa70a..830e318645 100644
--- a/libavformat/vividas.c
+++ b/libavformat/vividas.c
@@ -115,10 +115,7 @@  static unsigned recover_key(unsigned char sample[4], unsigned expected_size)
 
     put_v(plaintext+2, expected_size);
 
-    return (sample[0]^plaintext[0])|
-        ((sample[1]^plaintext[1])<<8)|
-        ((sample[2]^plaintext[2])<<16)|
-        ((sample[3]^plaintext[3])<<24);
+    return AV_RL32(sample) ^ AV_RL32(plaintext);
 }
 
 static void xor_block(void *p1, void *p2, unsigned size, int key, unsigned *key_ptr)