[FFmpeg-devel,2/6] avcodec/hevcdec: Check delta_luma_weight_l0/1

Submitted by Michael Niedermayer on Aug. 12, 2019, 12:17 a.m.

Details

Message ID 20190812001719.9247-2-michael@niedermayer.cc
State Accepted
Commit 021f29506b493376d62cdb5b9cb66a6b85e5361f
Headers show

Commit Message

Michael Niedermayer Aug. 12, 2019, 12:17 a.m.
Fixes: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
Fixes: 16041/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5685680656613376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/hevcdec.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

James Almer Aug. 12, 2019, 2:07 a.m.
On 8/11/2019 9:17 PM, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
> Fixes: 16041/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5685680656613376
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/hevcdec.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
> index f1934975d5..eed031913a 100644
> --- a/libavcodec/hevcdec.c
> +++ b/libavcodec/hevcdec.c
> @@ -182,6 +182,8 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
>      for (i = 0; i < s->sh.nb_refs[L0]; i++) {
>          if (luma_weight_l0_flag[i]) {
>              int delta_luma_weight_l0 = get_se_golomb(gb);
> +            if ((int8_t)delta_luma_weight_l0 != delta_luma_weight_l0)
> +                return AVERROR_INVALIDDATA;
>              s->sh.luma_weight_l0[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l0;
>              s->sh.luma_offset_l0[i] = get_se_golomb(gb);
>          }
> @@ -224,6 +226,8 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
>          for (i = 0; i < s->sh.nb_refs[L1]; i++) {
>              if (luma_weight_l1_flag[i]) {
>                  int delta_luma_weight_l1 = get_se_golomb(gb);
> +                if ((int8_t)delta_luma_weight_l1 != delta_luma_weight_l1)
> +                    return AVERROR_INVALIDDATA;
>                  s->sh.luma_weight_l1[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l1;
>                  s->sh.luma_offset_l1[i] = get_se_golomb(gb);
>              }
> 

LGTM.
Michael Niedermayer Aug. 13, 2019, 9:20 a.m.
On Sun, Aug 11, 2019 at 11:07:24PM -0300, James Almer wrote:
> On 8/11/2019 9:17 PM, Michael Niedermayer wrote:
> > Fixes: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
> > Fixes: 16041/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5685680656613376
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/hevcdec.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> > 
> > diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
> > index f1934975d5..eed031913a 100644
> > --- a/libavcodec/hevcdec.c
> > +++ b/libavcodec/hevcdec.c
> > @@ -182,6 +182,8 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
> >      for (i = 0; i < s->sh.nb_refs[L0]; i++) {
> >          if (luma_weight_l0_flag[i]) {
> >              int delta_luma_weight_l0 = get_se_golomb(gb);
> > +            if ((int8_t)delta_luma_weight_l0 != delta_luma_weight_l0)
> > +                return AVERROR_INVALIDDATA;
> >              s->sh.luma_weight_l0[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l0;
> >              s->sh.luma_offset_l0[i] = get_se_golomb(gb);
> >          }
> > @@ -224,6 +226,8 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
> >          for (i = 0; i < s->sh.nb_refs[L1]; i++) {
> >              if (luma_weight_l1_flag[i]) {
> >                  int delta_luma_weight_l1 = get_se_golomb(gb);
> > +                if ((int8_t)delta_luma_weight_l1 != delta_luma_weight_l1)
> > +                    return AVERROR_INVALIDDATA;
> >                  s->sh.luma_weight_l1[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l1;
> >                  s->sh.luma_offset_l1[i] = get_se_golomb(gb);
> >              }
> > 
> 
> LGTM.

will apply

thx

[...]

Patch hide | download patch | download mbox

diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
index f1934975d5..eed031913a 100644
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -182,6 +182,8 @@  static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
     for (i = 0; i < s->sh.nb_refs[L0]; i++) {
         if (luma_weight_l0_flag[i]) {
             int delta_luma_weight_l0 = get_se_golomb(gb);
+            if ((int8_t)delta_luma_weight_l0 != delta_luma_weight_l0)
+                return AVERROR_INVALIDDATA;
             s->sh.luma_weight_l0[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l0;
             s->sh.luma_offset_l0[i] = get_se_golomb(gb);
         }
@@ -224,6 +226,8 @@  static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
         for (i = 0; i < s->sh.nb_refs[L1]; i++) {
             if (luma_weight_l1_flag[i]) {
                 int delta_luma_weight_l1 = get_se_golomb(gb);
+                if ((int8_t)delta_luma_weight_l1 != delta_luma_weight_l1)
+                    return AVERROR_INVALIDDATA;
                 s->sh.luma_weight_l1[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l1;
                 s->sh.luma_offset_l1[i] = get_se_golomb(gb);
             }