| Message ID | 20220911142721.30812-2-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 9bfae838563b9cf7ced9053265cfdb4405bce7eb |
| Headers | show |
| Series | [FFmpeg-devel,1/5] avformat/mxfdec: Avoid some redundant writing to tables in mxf_compute_ptses_fake_index() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Sun, Sep 11, 2022 at 04:27:18PM +0200, Michael Niedermayer wrote: > Untested with "non fuzzed" samples as i have no such file > > Fixes: shift exponent 32 is too large for 32-bit type 'int' > Fixes: 50930/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6319201949712384 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/wavpack.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) will apply [...]
On 9/11/22, Michael Niedermayer <michael@niedermayer.cc> wrote: > Untested with "non fuzzed" samples as i have no such file > Then create it. > Fixes: shift exponent 32 is too large for 32-bit type 'int' > Fixes: > 50930/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6319201949712384 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/wavpack.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > index 7aa1f65e17b..b4d19df7ea2 100644 > --- a/libavcodec/wavpack.c > +++ b/libavcodec/wavpack.c > @@ -126,7 +126,7 @@ static av_always_inline unsigned get_tail(GetBitContext > *gb, unsigned k) > if (k < 1) > return 0; > p = av_log2(k); > - e = (1 << (p + 1)) - k - 1; > + e = (1LL << (p + 1)) - k - 1; > res = get_bits_long(gb, p); > if (res >= e) > res = (res << 1) - e + get_bits1(gb); > -- > 2.17.1 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". >
On Wed, Nov 30, 2022 at 09:39:44PM +0100, Paul B Mahol wrote: > On 9/11/22, Michael Niedermayer <michael@niedermayer.cc> wrote: > > Untested with "non fuzzed" samples as i have no such file > > > > Then create it. the official WavPack-5.6.0 decoder has 2 alternative optimized codepathes #ifdef USE_BITMASK_TABLES extras = bitset [bitcount] - maxcode - 1; #else extras = (1 << bitcount) - maxcode - 1; #endif The 2nd path would result in the same 1<<32 which is undefined but luckily the first seems hardcoded to be used it uses this table: const uint32_t bitset [] = { 1L << 0, 1L << 1, 1L << 2, 1L << 3, 1L << 4, 1L << 5, 1L << 6, 1L << 7, 1L << 8, 1L << 9, 1L << 10, 1L << 11, 1L << 12, 1L << 13, 1L << 14, 1L << 15, 1L << 16, 1L << 17, 1L << 18, 1L << 19, 1L << 20, 1L << 21, 1L << 22, 1L << 23, 1L << 24, 1L << 25, 1L << 26, 1L << 27, 1L << 28, 1L << 29, 1L << 30, 1L << 31 }; here bitset[32] is out of array Given above i suspect no valid file should use this. Otherwise something seriously odd is going on. also the subject has a typo its p=31 not k=31 thx [...]
On Thu, Dec 1, 2022 at 8:56 PM Michael Niedermayer <michael@niedermayer.cc> wrote: > On Wed, Nov 30, 2022 at 09:39:44PM +0100, Paul B Mahol wrote: > > On 9/11/22, Michael Niedermayer <michael@niedermayer.cc> wrote: > > > Untested with "non fuzzed" samples as i have no such file > > > > > > > Then create it. > > the official WavPack-5.6.0 decoder has 2 alternative optimized codepathes > #ifdef USE_BITMASK_TABLES > extras = bitset [bitcount] - maxcode - 1; > #else > extras = (1 << bitcount) - maxcode - 1; > #endif > > The 2nd path would result in the same 1<<32 which is undefined but luckily > the first seems hardcoded to be used it uses this table: > > const uint32_t bitset [] = { > 1L << 0, 1L << 1, 1L << 2, 1L << 3, > 1L << 4, 1L << 5, 1L << 6, 1L << 7, > 1L << 8, 1L << 9, 1L << 10, 1L << 11, > 1L << 12, 1L << 13, 1L << 14, 1L << 15, > 1L << 16, 1L << 17, 1L << 18, 1L << 19, > 1L << 20, 1L << 21, 1L << 22, 1L << 23, > 1L << 24, 1L << 25, 1L << 26, 1L << 27, > 1L << 28, 1L << 29, 1L << 30, 1L << 31 > }; > > here bitset[32] is out of array > > Given above i suspect no valid file should use this. Otherwise something > seriously odd is going on. > > also the subject has a typo its p=31 not k=31 > > thx > OK > > [...] > > -- > Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB > > The real ebay dictionary, page 2 > "100% positive feedback" - "All either got their money back or didnt > complain" > "Best seller ever, very honest" - "Seller refunded buyer after failed scam" > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". >
On Fri, Dec 02, 2022 at 05:14:58PM +0100, Paul B Mahol wrote: > On Thu, Dec 1, 2022 at 8:56 PM Michael Niedermayer <michael@niedermayer.cc> > wrote: > > > On Wed, Nov 30, 2022 at 09:39:44PM +0100, Paul B Mahol wrote: > > > On 9/11/22, Michael Niedermayer <michael@niedermayer.cc> wrote: > > > > Untested with "non fuzzed" samples as i have no such file > > > > > > > > > > Then create it. > > > > the official WavPack-5.6.0 decoder has 2 alternative optimized codepathes > > #ifdef USE_BITMASK_TABLES > > extras = bitset [bitcount] - maxcode - 1; > > #else > > extras = (1 << bitcount) - maxcode - 1; > > #endif > > > > The 2nd path would result in the same 1<<32 which is undefined but luckily > > the first seems hardcoded to be used it uses this table: > > > > const uint32_t bitset [] = { > > 1L << 0, 1L << 1, 1L << 2, 1L << 3, > > 1L << 4, 1L << 5, 1L << 6, 1L << 7, > > 1L << 8, 1L << 9, 1L << 10, 1L << 11, > > 1L << 12, 1L << 13, 1L << 14, 1L << 15, > > 1L << 16, 1L << 17, 1L << 18, 1L << 19, > > 1L << 20, 1L << 21, 1L << 22, 1L << 23, > > 1L << 24, 1L << 25, 1L << 26, 1L << 27, > > 1L << 28, 1L << 29, 1L << 30, 1L << 31 > > }; > > > > here bitset[32] is out of array > > > > Given above i suspect no valid file should use this. Otherwise something > > seriously odd is going on. > > > > also the subject has a typo its p=31 not k=31 > > > > thx > > > > OK will apply thx [...]
diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index 7aa1f65e17b..b4d19df7ea2 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -126,7 +126,7 @@ static av_always_inline unsigned get_tail(GetBitContext *gb, unsigned k) if (k < 1) return 0; p = av_log2(k); - e = (1 << (p + 1)) - k - 1; + e = (1LL << (p + 1)) - k - 1; res = get_bits_long(gb, p); if (res >= e) res = (res << 1) - e + get_bits1(gb);
Untested with "non fuzzed" samples as i have no such file Fixes: shift exponent 32 is too large for 32-bit type 'int' Fixes: 50930/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6319201949712384 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/wavpack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)