| Message ID | 20200924202039.30285-4-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avcodec/svq3: dont crash on free_picture(NULL) | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
Michael Niedermayer: > Fixes: heap-buffer-overflow > Fixes: 25744/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5172961169113088 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/sonic.c | 11 +++++------ > 1 file changed, 5 insertions(+), 6 deletions(-) > > diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c > index fa4ecc3a7a..d09de6156b 100644 > --- a/libavcodec/sonic.c > +++ b/libavcodec/sonic.c > @@ -980,12 +980,11 @@ static av_cold int sonic_decode_close(AVCodecContext *avctx) > av_freep(&s->int_samples); > av_freep(&s->tap_quant); > av_freep(&s->predictor_k); > - > - for (i = 0; i < s->channels; i++) > - { > - av_freep(&s->predictor_state[i]); > - av_freep(&s->coded_samples[i]); > - } > + if (s->channels <= MAX_CHANNELS) > + for (i = 0; i < s->channels; i++) { > + av_freep(&s->predictor_state[i]); > + av_freep(&s->coded_samples[i]); > + } > > return 0; > } > for (i = 0; i < MAX_CHANNELS; i++) would be simpler. (Sorry for not noticing this before 7d91f9271ee336da93b6871bf3306348ac1595a7; I only tested that everything's fine when one of the allocations is made to fail.) - Andreas
On Thu, Sep 24, 2020 at 10:58:22PM +0200, Andreas Rheinhardt wrote: > Michael Niedermayer: > > Fixes: heap-buffer-overflow > > Fixes: 25744/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5172961169113088 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/sonic.c | 11 +++++------ > > 1 file changed, 5 insertions(+), 6 deletions(-) > > > > diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c > > index fa4ecc3a7a..d09de6156b 100644 > > --- a/libavcodec/sonic.c > > +++ b/libavcodec/sonic.c > > @@ -980,12 +980,11 @@ static av_cold int sonic_decode_close(AVCodecContext *avctx) > > av_freep(&s->int_samples); > > av_freep(&s->tap_quant); > > av_freep(&s->predictor_k); > > - > > - for (i = 0; i < s->channels; i++) > > - { > > - av_freep(&s->predictor_state[i]); > > - av_freep(&s->coded_samples[i]); > > - } > > + if (s->channels <= MAX_CHANNELS) > > + for (i = 0; i < s->channels; i++) { > > + av_freep(&s->predictor_state[i]); > > + av_freep(&s->coded_samples[i]); > > + } > > > > return 0; > > } > > > for (i = 0; i < MAX_CHANNELS; i++) would be simpler. ok will apply with that thx [...]
diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c index fa4ecc3a7a..d09de6156b 100644 --- a/libavcodec/sonic.c +++ b/libavcodec/sonic.c @@ -980,12 +980,11 @@ static av_cold int sonic_decode_close(AVCodecContext *avctx) av_freep(&s->int_samples); av_freep(&s->tap_quant); av_freep(&s->predictor_k); - - for (i = 0; i < s->channels; i++) - { - av_freep(&s->predictor_state[i]); - av_freep(&s->coded_samples[i]); - } + if (s->channels <= MAX_CHANNELS) + for (i = 0; i < s->channels; i++) { + av_freep(&s->predictor_state[i]); + av_freep(&s->coded_samples[i]); + } return 0; }
Fixes: heap-buffer-overflow Fixes: 25744/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5172961169113088 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/sonic.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)