| Message ID | 20180427194407.24276-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 4dd2c8b9ea46b4e008a8bfc2077834428cd5a17c |
| Headers | show |
On Fri, Apr 27, 2018 at 09:44:05PM +0200, Michael Niedermayer wrote: > Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int' > Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/g2meet.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c > index b409dae813..105a40278f 100644 > --- a/libavcodec/g2meet.c > +++ b/libavcodec/g2meet.c > @@ -556,7 +556,7 @@ static uint32_t epic_decode_pixel_pred(ePICContext *dc, int x, int y, > B = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta); > } > > - if (R<0 || G<0 || B<0) { > + if (R<0 || G<0 || B<0 || R > 255 || G > 255 || B > 255) { > av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of range\n", R, G, B); > return 0; i saw someone asked why this doesnt clip on the IRC backlog There is AFAIK no public spec so theres nothing really solid to base a preferrance on. I favor a hard error as it is easier t debug in case it misbehaves. silently cliping (if its wrong) leads to more difficult to trace issues. But if people prefer i can change it to clip of course. Thanks [...]
sön 2018-04-29 klockan 16:41 +0200 skrev Michael Niedermayer: > On Fri, Apr 27, 2018 at 09:44:05PM +0200, Michael Niedermayer wrote: > > Fixes: runtime error: left shift of 1876744317 by 16 places cannot > > be represented in type 'int' > > Fixes: 6799/clusterfuzz-testcase-minimized- > > ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608 > > > > Found-by: continuous fuzzing process https://github.com/google/oss- > > fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/g2meet.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c > > index b409dae813..105a40278f 100644 > > --- a/libavcodec/g2meet.c > > +++ b/libavcodec/g2meet.c > > @@ -556,7 +556,7 @@ static uint32_t > > epic_decode_pixel_pred(ePICContext *dc, int x, int y, > > B = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta); > > } > > > > - if (R<0 || G<0 || B<0) { > > + if (R<0 || G<0 || B<0 || R > 255 || G > 255 || B > 255) { > > av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of > > range\n", R, G, B); > > return 0; > > i saw someone asked why this doesnt clip on the IRC backlog > > There is AFAIK no public spec so theres nothing really solid to base > a > preferrance on. > > I favor a hard error as it is easier t debug in case it misbehaves. > silently cliping (if its wrong) leads to more difficult to trace > issues. > > But if people prefer i can change it to clip of course. Be as strict as possible and ask for samples if someone has a file that breaks these expectations /Tomas
On Sun, Apr 29, 2018 at 06:44:23PM +0200, Tomas Härdin wrote: > sön 2018-04-29 klockan 16:41 +0200 skrev Michael Niedermayer: > > On Fri, Apr 27, 2018 at 09:44:05PM +0200, Michael Niedermayer wrote: > > > Fixes: runtime error: left shift of 1876744317 by 16 places cannot > > > be represented in type 'int' > > > Fixes: 6799/clusterfuzz-testcase-minimized- > > > ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608 > > > > > > Found-by: continuous fuzzing process https://github.com/google/oss- > > > fuzz/tree/master/projects/ffmpeg > > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > > --- > > > libavcodec/g2meet.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c > > > index b409dae813..105a40278f 100644 > > > --- a/libavcodec/g2meet.c > > > +++ b/libavcodec/g2meet.c > > > @@ -556,7 +556,7 @@ static uint32_t > > > epic_decode_pixel_pred(ePICContext *dc, int x, int y, > > > B = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta); > > > } > > > > > > - if (R<0 || G<0 || B<0) { > > > + if (R<0 || G<0 || B<0 || R > 255 || G > 255 || B > 255) { > > > av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of > > > range\n", R, G, B); > > > return 0; > > > > i saw someone asked why this doesnt clip on the IRC backlog > > > > There is AFAIK no public spec so theres nothing really solid to base > > a > > preferrance on. > > > > I favor a hard error as it is easier t debug in case it misbehaves. > > silently cliping (if its wrong) leads to more difficult to trace > > issues. > > > > But if people prefer i can change it to clip of course. > > Be as strict as possible and ask for samples if someone has a file that > breaks these expectations > ok will do thanks [...]
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c index b409dae813..105a40278f 100644 --- a/libavcodec/g2meet.c +++ b/libavcodec/g2meet.c @@ -556,7 +556,7 @@ static uint32_t epic_decode_pixel_pred(ePICContext *dc, int x, int y, B = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta); } - if (R<0 || G<0 || B<0) { + if (R<0 || G<0 || B<0 || R > 255 || G > 255 || B > 255) { av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of range\n", R, G, B); return 0; }
Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int' Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/g2meet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)