| Message ID | 20200502210807.18754-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 30f5d6751047bbe8974f016c9745da9cd2daa3fc |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avcodec/wavpack: Check rate_x and sample rate for overflow | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
On 5/2/20 2:08 PM, Michael Niedermayer wrote: > Fixes: shift exponent 32 is too large for 32-bit type 'int' > Fixes: 21647/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5686168323883008 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/wavpack.c | 13 ++++++++++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > index 58ab561a15..ead57063c8 100644 > --- a/libavcodec/wavpack.c > +++ b/libavcodec/wavpack.c > @@ -1359,7 +1359,10 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, > bytestream2_skip(&gb, ssize); > continue; > } > - rate_x = 1 << bytestream2_get_byte(&gb); > + rate_x = bytestream2_get_byte(&gb); > + if (rate_x > 30) > + return AVERROR_INVALIDDATA; > + rate_x = 1 << rate_x; > dsd_mode = bytestream2_get_byte(&gb); > if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) { > av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: %d\n", > @@ -1498,9 +1501,13 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, > av_log(avctx, AV_LOG_ERROR, "Custom sample rate missing.\n"); > return AVERROR_INVALIDDATA; > } > - new_samplerate = sample_rate * rate_x; > + new_samplerate = sample_rate; > } else > - new_samplerate = wv_rates[sr] * rate_x; > + new_samplerate = wv_rates[sr]; > + > + if (new_samplerate * (uint64_t)rate_x > INT_MAX) > + return AVERROR_INVALIDDATA; > + new_samplerate *= rate_x; > > if (multiblock) { > if (chan) Looks correct to me. Thanks.
On Sun, May 03, 2020 at 04:13:47PM -0700, David Bryant wrote: > On 5/2/20 2:08 PM, Michael Niedermayer wrote: > > Fixes: shift exponent 32 is too large for 32-bit type 'int' > > Fixes: 21647/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5686168323883008 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/wavpack.c | 13 ++++++++++--- > > 1 file changed, 10 insertions(+), 3 deletions(-) > > > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > > index 58ab561a15..ead57063c8 100644 > > --- a/libavcodec/wavpack.c > > +++ b/libavcodec/wavpack.c > > @@ -1359,7 +1359,10 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, > > bytestream2_skip(&gb, ssize); > > continue; > > } > > - rate_x = 1 << bytestream2_get_byte(&gb); > > + rate_x = bytestream2_get_byte(&gb); > > + if (rate_x > 30) > > + return AVERROR_INVALIDDATA; > > + rate_x = 1 << rate_x; > > dsd_mode = bytestream2_get_byte(&gb); > > if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) { > > av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: %d\n", > > @@ -1498,9 +1501,13 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, > > av_log(avctx, AV_LOG_ERROR, "Custom sample rate missing.\n"); > > return AVERROR_INVALIDDATA; > > } > > - new_samplerate = sample_rate * rate_x; > > + new_samplerate = sample_rate; > > } else > > - new_samplerate = wv_rates[sr] * rate_x; > > + new_samplerate = wv_rates[sr]; > > + > > + if (new_samplerate * (uint64_t)rate_x > INT_MAX) > > + return AVERROR_INVALIDDATA; > > + new_samplerate *= rate_x; > > > > if (multiblock) { > > if (chan) > > Looks correct to me. Thanks. will apply thx [...]
diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index 58ab561a15..ead57063c8 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -1359,7 +1359,10 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, bytestream2_skip(&gb, ssize); continue; } - rate_x = 1 << bytestream2_get_byte(&gb); + rate_x = bytestream2_get_byte(&gb); + if (rate_x > 30) + return AVERROR_INVALIDDATA; + rate_x = 1 << rate_x; dsd_mode = bytestream2_get_byte(&gb); if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) { av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: %d\n", @@ -1498,9 +1501,13 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, av_log(avctx, AV_LOG_ERROR, "Custom sample rate missing.\n"); return AVERROR_INVALIDDATA; } - new_samplerate = sample_rate * rate_x; + new_samplerate = sample_rate; } else - new_samplerate = wv_rates[sr] * rate_x; + new_samplerate = wv_rates[sr]; + + if (new_samplerate * (uint64_t)rate_x > INT_MAX) + return AVERROR_INVALIDDATA; + new_samplerate *= rate_x; if (multiblock) { if (chan)
Fixes: shift exponent 32 is too large for 32-bit type 'int' Fixes: 21647/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5686168323883008 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/wavpack.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)