diff mbox series

[FFmpeg-devel,2/5] avcodec/wavpack: Fix overflow in k=31

Message ID 20220911142721.30812-2-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/5] avformat/mxfdec: Avoid some redundant writing to tables in mxf_compute_ptses_fake_index() | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Sept. 11, 2022, 2:27 p.m. UTC
Untested with "non fuzzed" samples as i have no such file

Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 50930/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6319201949712384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/wavpack.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Michael Niedermayer Nov. 30, 2022, 8:25 p.m. UTC | #1
On Sun, Sep 11, 2022 at 04:27:18PM +0200, Michael Niedermayer wrote:
> Untested with "non fuzzed" samples as i have no such file
> 
> Fixes: shift exponent 32 is too large for 32-bit type 'int'
> Fixes: 50930/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6319201949712384
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/wavpack.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

will apply

[...]
Paul B Mahol Nov. 30, 2022, 8:39 p.m. UTC | #2
On 9/11/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> Untested with "non fuzzed" samples as i have no such file
>

Then create it.

> Fixes: shift exponent 32 is too large for 32-bit type 'int'
> Fixes:
> 50930/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6319201949712384
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/wavpack.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c
> index 7aa1f65e17b..b4d19df7ea2 100644
> --- a/libavcodec/wavpack.c
> +++ b/libavcodec/wavpack.c
> @@ -126,7 +126,7 @@ static av_always_inline unsigned get_tail(GetBitContext
> *gb, unsigned k)
>      if (k < 1)
>          return 0;
>      p   = av_log2(k);
> -    e   = (1 << (p + 1)) - k - 1;
> +    e   = (1LL << (p + 1)) - k - 1;
>      res = get_bits_long(gb, p);
>      if (res >= e)
>          res = (res << 1) - e + get_bits1(gb);
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
Michael Niedermayer Dec. 1, 2022, 7:56 p.m. UTC | #3
On Wed, Nov 30, 2022 at 09:39:44PM +0100, Paul B Mahol wrote:
> On 9/11/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > Untested with "non fuzzed" samples as i have no such file
> >
> 
> Then create it.

the official WavPack-5.6.0 decoder has 2 alternative optimized codepathes
#ifdef USE_BITMASK_TABLES
    extras = bitset [bitcount] - maxcode - 1;
#else
    extras = (1 << bitcount) - maxcode - 1;
#endif

The 2nd path would result in the same 1<<32 which is undefined but luckily
the first seems hardcoded to be used it uses this table:

const uint32_t bitset [] = {
    1L << 0, 1L << 1, 1L << 2, 1L << 3,
    1L << 4, 1L << 5, 1L << 6, 1L << 7,
    1L << 8, 1L << 9, 1L << 10, 1L << 11,
    1L << 12, 1L << 13, 1L << 14, 1L << 15,
    1L << 16, 1L << 17, 1L << 18, 1L << 19,
    1L << 20, 1L << 21, 1L << 22, 1L << 23,
    1L << 24, 1L << 25, 1L << 26, 1L << 27,
    1L << 28, 1L << 29, 1L << 30, 1L << 31
};

here bitset[32] is out of array

Given above i suspect no valid file should use this. Otherwise something
seriously odd is going on.

also the subject has a typo its p=31 not k=31

thx

[...]
Paul B Mahol Dec. 2, 2022, 4:14 p.m. UTC | #4
On Thu, Dec 1, 2022 at 8:56 PM Michael Niedermayer <michael@niedermayer.cc>
wrote:

> On Wed, Nov 30, 2022 at 09:39:44PM +0100, Paul B Mahol wrote:
> > On 9/11/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > > Untested with "non fuzzed" samples as i have no such file
> > >
> >
> > Then create it.
>
> the official WavPack-5.6.0 decoder has 2 alternative optimized codepathes
> #ifdef USE_BITMASK_TABLES
>     extras = bitset [bitcount] - maxcode - 1;
> #else
>     extras = (1 << bitcount) - maxcode - 1;
> #endif
>
> The 2nd path would result in the same 1<<32 which is undefined but luckily
> the first seems hardcoded to be used it uses this table:
>
> const uint32_t bitset [] = {
>     1L << 0, 1L << 1, 1L << 2, 1L << 3,
>     1L << 4, 1L << 5, 1L << 6, 1L << 7,
>     1L << 8, 1L << 9, 1L << 10, 1L << 11,
>     1L << 12, 1L << 13, 1L << 14, 1L << 15,
>     1L << 16, 1L << 17, 1L << 18, 1L << 19,
>     1L << 20, 1L << 21, 1L << 22, 1L << 23,
>     1L << 24, 1L << 25, 1L << 26, 1L << 27,
>     1L << 28, 1L << 29, 1L << 30, 1L << 31
> };
>
> here bitset[32] is out of array
>
> Given above i suspect no valid file should use this. Otherwise something
> seriously odd is going on.
>
> also the subject has a typo its p=31 not k=31
>
> thx
>

OK


>
> [...]
>
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> The real ebay dictionary, page 2
> "100% positive feedback" - "All either got their money back or didnt
> complain"
> "Best seller ever, very honest" - "Seller refunded buyer after failed scam"
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
Michael Niedermayer Dec. 2, 2022, 11:11 p.m. UTC | #5
On Fri, Dec 02, 2022 at 05:14:58PM +0100, Paul B Mahol wrote:
> On Thu, Dec 1, 2022 at 8:56 PM Michael Niedermayer <michael@niedermayer.cc>
> wrote:
> 
> > On Wed, Nov 30, 2022 at 09:39:44PM +0100, Paul B Mahol wrote:
> > > On 9/11/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > > > Untested with "non fuzzed" samples as i have no such file
> > > >
> > >
> > > Then create it.
> >
> > the official WavPack-5.6.0 decoder has 2 alternative optimized codepathes
> > #ifdef USE_BITMASK_TABLES
> >     extras = bitset [bitcount] - maxcode - 1;
> > #else
> >     extras = (1 << bitcount) - maxcode - 1;
> > #endif
> >
> > The 2nd path would result in the same 1<<32 which is undefined but luckily
> > the first seems hardcoded to be used it uses this table:
> >
> > const uint32_t bitset [] = {
> >     1L << 0, 1L << 1, 1L << 2, 1L << 3,
> >     1L << 4, 1L << 5, 1L << 6, 1L << 7,
> >     1L << 8, 1L << 9, 1L << 10, 1L << 11,
> >     1L << 12, 1L << 13, 1L << 14, 1L << 15,
> >     1L << 16, 1L << 17, 1L << 18, 1L << 19,
> >     1L << 20, 1L << 21, 1L << 22, 1L << 23,
> >     1L << 24, 1L << 25, 1L << 26, 1L << 27,
> >     1L << 28, 1L << 29, 1L << 30, 1L << 31
> > };
> >
> > here bitset[32] is out of array
> >
> > Given above i suspect no valid file should use this. Otherwise something
> > seriously odd is going on.
> >
> > also the subject has a typo its p=31 not k=31
> >
> > thx
> >
> 
> OK

will apply

thx

[...]
diff mbox series

Patch

diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c
index 7aa1f65e17b..b4d19df7ea2 100644
--- a/libavcodec/wavpack.c
+++ b/libavcodec/wavpack.c
@@ -126,7 +126,7 @@  static av_always_inline unsigned get_tail(GetBitContext *gb, unsigned k)
     if (k < 1)
         return 0;
     p   = av_log2(k);
-    e   = (1 << (p + 1)) - k - 1;
+    e   = (1LL << (p + 1)) - k - 1;
     res = get_bits_long(gb, p);
     if (res >= e)
         res = (res << 1) - e + get_bits1(gb);