| Message ID | 20220201185239.13450-2-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 4fdfe430c12225e819f68993474bd2f473c7e8b1 |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avformat/utils: keep chapter monotonicity on chapter updates | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_aarch64_jetson | success | Make finished |
| andriy/make_fate_aarch64_jetson | success | Make fate finished |
| andriy/make_armv7_RPi4 | success | Make finished |
| andriy/make_fate_armv7_RPi4 | success | Make fate finished |
On Tue, Feb 01, 2022 at 07:52:39PM +0100, Michael Niedermayer wrote: > Fixes: division by zero > Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/av1dec.c | 3 +++ > 1 file changed, 3 insertions(+) will apply [...]
On 2/1/2022 3:52 PM, Michael Niedermayer wrote: > Fixes: division by zero > Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/av1dec.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c > index 62d459cded..581f22a849 100644 > --- a/libavcodec/av1dec.c > +++ b/libavcodec/av1dec.c > @@ -394,6 +394,9 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro > s->tg_start = tile_group->tg_start; > s->tg_end = tile_group->tg_end; > > + if (s->raw_frame_header->tile_cols == 0) This should not happen. CBS should have returned an error instead or setting tile_cols to 0. The bug should probably be fixed there. > + return AVERROR_INVALIDDATA; > + > for (tile_num = tile_group->tg_start; tile_num <= tile_group->tg_end; tile_num++) { > tile_row = tile_num / s->raw_frame_header->tile_cols; > tile_col = tile_num % s->raw_frame_header->tile_cols;
On Mon, Mar 21, 2022 at 06:03:12PM -0300, James Almer wrote: > On 2/1/2022 3:52 PM, Michael Niedermayer wrote: > > Fixes: division by zero > > Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/av1dec.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c > > index 62d459cded..581f22a849 100644 > > --- a/libavcodec/av1dec.c > > +++ b/libavcodec/av1dec.c > > @@ -394,6 +394,9 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro > > s->tg_start = tile_group->tg_start; > > s->tg_end = tile_group->tg_end; > > + if (s->raw_frame_header->tile_cols == 0) > > This should not happen. CBS should have returned an error instead or setting > tile_cols to 0. > The bug should probably be fixed there. I didnt see your mail in time :( If you want, i can revert it? The issue seems that cbs av1 and av1dec disagree on how they handle redundant frames. I can "fix" it by --- a/libavcodec/av1dec.c +++ b/libavcodec/av1dec.c @@ -1066,8 +1066,8 @@ static int av1_decode_frame(AVCodecContext *avctx, void *frame, } break; case AV1_OBU_REDUNDANT_FRAME_HEADER: - if (s->raw_frame_header) - break; + // Unsupported + break; // fall-through case AV1_OBU_FRAME: case AV1_OBU_FRAME_HEADER: cbs leaves tile_cols untouched (and 0) for the redundant frame I didnt really look further, this probably should be looked at by someone who knows the av1dec/cbs code better. I can provide the sample file if someone wants to or also test any suggested fixes I think this split logic where cbs and the decoder have to be kept in sync is a bit fragile. Or at least it looks fragile Thx [...]
diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c index 62d459cded..581f22a849 100644 --- a/libavcodec/av1dec.c +++ b/libavcodec/av1dec.c @@ -394,6 +394,9 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro s->tg_start = tile_group->tg_start; s->tg_end = tile_group->tg_end; + if (s->raw_frame_header->tile_cols == 0) + return AVERROR_INVALIDDATA; + for (tile_num = tile_group->tg_start; tile_num <= tile_group->tg_end; tile_num++) { tile_row = tile_num / s->raw_frame_header->tile_cols; tile_col = tile_num % s->raw_frame_header->tile_cols;
Fixes: division by zero Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/av1dec.c | 3 +++ 1 file changed, 3 insertions(+)