[FFmpeg-devel,1/6] avcodec/alac: Check for bps of 0

Submitted by Michael Niedermayer on Aug. 25, 2019, 6:41 p.m.

Details

Message ID 20190825184158.10244-1-michael@niedermayer.cc
State Accepted
Commit 8f49176e845fee8e4e0aaf06411636b46d1ae3ad
Headers show

Commit Message

Michael Niedermayer Aug. 25, 2019, 6:41 p.m.
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/alac.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

James Almer Aug. 25, 2019, 8:46 p.m.
On 8/25/2019 3:41 PM, Michael Niedermayer wrote:
> Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
> Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/alac.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/libavcodec/alac.c b/libavcodec/alac.c
> index 6086e2caa8..782d461b22 100644
> --- a/libavcodec/alac.c
> +++ b/libavcodec/alac.c
> @@ -250,10 +250,12 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
>  
>      alac->extra_bits = get_bits(&alac->gb, 2) << 3;
>      bps = alac->sample_size - alac->extra_bits + channels - 1;
> -    if (bps > 32U) {
> +    if (bps > 32) {
>          avpriv_report_missing_feature(avctx, "bps %d", bps);
>          return AVERROR_PATCHWELCOME;
>      }
> +    if (bps < 1)
> +        return AVERROR_INVALIDDATA;
>  
>      /* whether the frame is compressed */
>      is_compressed = !get_bits1(&alac->gb);

LGTM.
Michael Niedermayer Aug. 25, 2019, 9:28 p.m.
On Sun, Aug 25, 2019 at 05:46:10PM -0300, James Almer wrote:
> On 8/25/2019 3:41 PM, Michael Niedermayer wrote:
> > Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
> > Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/alac.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/alac.c b/libavcodec/alac.c
> > index 6086e2caa8..782d461b22 100644
> > --- a/libavcodec/alac.c
> > +++ b/libavcodec/alac.c
> > @@ -250,10 +250,12 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
> >  
> >      alac->extra_bits = get_bits(&alac->gb, 2) << 3;
> >      bps = alac->sample_size - alac->extra_bits + channels - 1;
> > -    if (bps > 32U) {
> > +    if (bps > 32) {
> >          avpriv_report_missing_feature(avctx, "bps %d", bps);
> >          return AVERROR_PATCHWELCOME;
> >      }
> > +    if (bps < 1)
> > +        return AVERROR_INVALIDDATA;
> >  
> >      /* whether the frame is compressed */
> >      is_compressed = !get_bits1(&alac->gb);
> 
> LGTM.

will apply

[...]

Patch hide | download patch | download mbox

diff --git a/libavcodec/alac.c b/libavcodec/alac.c
index 6086e2caa8..782d461b22 100644
--- a/libavcodec/alac.c
+++ b/libavcodec/alac.c
@@ -250,10 +250,12 @@  static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
 
     alac->extra_bits = get_bits(&alac->gb, 2) << 3;
     bps = alac->sample_size - alac->extra_bits + channels - 1;
-    if (bps > 32U) {
+    if (bps > 32) {
         avpriv_report_missing_feature(avctx, "bps %d", bps);
         return AVERROR_PATCHWELCOME;
     }
+    if (bps < 1)
+        return AVERROR_INVALIDDATA;
 
     /* whether the frame is compressed */
     is_compressed = !get_bits1(&alac->gb);