| Message ID | 20201218232208.14207-5-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | f1700bd8bb983bb3b56c3a1f8b9078cb62a44f65 |
| Headers | show |
| Series | [FFmpeg-devel,1/8] avformat/mpegts: Increase pcr_incr width to 64bit | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
On 12/18/2020 8:22 PM, Michael Niedermayer wrote: > Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int' > Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480 > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/hevc_ps.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c > index ea6fd536c6..139f3deeda 100644 > --- a/libavcodec/hevc_ps.c > +++ b/libavcodec/hevc_ps.c > @@ -816,7 +816,11 @@ static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingLi > next_coef = 8; > coef_num = FFMIN(64, 1 << (4 + (size_id << 1))); > if (size_id > 1) { > - scaling_list_dc_coef[size_id - 2][matrix_id] = get_se_golomb(gb) + 8; > + int scaling_list_coeff_minus8 = get_se_golomb(gb); > + if (scaling_list_coeff_minus8 < -7 || > + scaling_list_coeff_minus8 > 247) LGTM, this check is also done in CBS so i assume it's taken from the spec. > + return AVERROR_INVALIDDATA; > + scaling_list_dc_coef[size_id - 2][matrix_id] = scaling_list_coeff_minus8 + 8; Not strictly related to this patch, but this array could be made into an uint8_t now. > next_coef = scaling_list_dc_coef[size_id - 2][matrix_id]; > sl->sl_dc[size_id - 2][matrix_id] = next_coef; > } >
On Fri, Dec 18, 2020 at 08:45:32PM -0300, James Almer wrote: > On 12/18/2020 8:22 PM, Michael Niedermayer wrote: > > Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int' > > Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480 > > > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/hevc_ps.c | 6 +++++- > > 1 file changed, 5 insertions(+), 1 deletion(-) > > > > diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c > > index ea6fd536c6..139f3deeda 100644 > > --- a/libavcodec/hevc_ps.c > > +++ b/libavcodec/hevc_ps.c > > @@ -816,7 +816,11 @@ static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingLi > > next_coef = 8; > > coef_num = FFMIN(64, 1 << (4 + (size_id << 1))); > > if (size_id > 1) { > > - scaling_list_dc_coef[size_id - 2][matrix_id] = get_se_golomb(gb) + 8; > > + int scaling_list_coeff_minus8 = get_se_golomb(gb); > > + if (scaling_list_coeff_minus8 < -7 || > > + scaling_list_coeff_minus8 > 247) > > LGTM, this check is also done in CBS so i assume it's taken from the spec. yes > > > + return AVERROR_INVALIDDATA; > > + scaling_list_dc_coef[size_id - 2][matrix_id] = scaling_list_coeff_minus8 + 8; > > Not strictly related to this patch, but this array could be made into an > uint8_t now. yes, will change that too thx [...]
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index ea6fd536c6..139f3deeda 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -816,7 +816,11 @@ static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingLi next_coef = 8; coef_num = FFMIN(64, 1 << (4 + (size_id << 1))); if (size_id > 1) { - scaling_list_dc_coef[size_id - 2][matrix_id] = get_se_golomb(gb) + 8; + int scaling_list_coeff_minus8 = get_se_golomb(gb); + if (scaling_list_coeff_minus8 < -7 || + scaling_list_coeff_minus8 > 247) + return AVERROR_INVALIDDATA; + scaling_list_dc_coef[size_id - 2][matrix_id] = scaling_list_coeff_minus8 + 8; next_coef = scaling_list_dc_coef[size_id - 2][matrix_id]; sl->sl_dc[size_id - 2][matrix_id] = next_coef; }
Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int' Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/hevc_ps.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)