From patchwork Sat Nov 5 20:16:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 39181 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a21:999a:b0:a4:2148:650a with SMTP id ve26csp1198716pzb; Sat, 5 Nov 2022 13:16:51 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6XJSMn7CeVBUa+XO3XIG7rVGK4p6sALv9MSA+6DmrAcCrbRjyMUP5E78VlsrDor5PENu/0 X-Received: by 2002:a17:907:9809:b0:7ad:d945:554f with SMTP id ji9-20020a170907980900b007add945554fmr30783642ejc.552.1667679411217; Sat, 05 Nov 2022 13:16:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1667679411; cv=none; d=google.com; s=arc-20160816; b=aNhkDjjU/WGfFxMR4BNcIQc7O/KwI2KXTw3Ns+kyHxw/GgGk6II/jmoqolXBdgL9pH lpnkJIrXnzk/7xe8cS1gMDI9blXSvPlLMheLnt44JhtqcUfmVb/jASELwVgsP+iunNBw r6NAwEN0Bcuk23Vl4jZ8wxSEYfXEYooIZmxuwrTLmtfP1sV8TqvlJMLam6+KMpsk7hIO H9yJcSai+Q/2vW2Qf54hIRh28heTxfP39kZPbcwPjyl1CKjtgUXPD2QtxexcbNr7xLTN WVBdFOZe4xgxHL7BmM1DDWmKvm9j6/eKZxTy020uSoW1fsBG3ffplAfywTf4brppFSkS M7Bw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:delivered-to; bh=ZqXAEK264ST8yjK1g9acvSM0hxlfV+YrPCuznKnPG+c=; b=uEsJDwmtErQ2teI89Or9zlOnAGrtUaTiQqCNti8oFBbBBC0aIfhFh3TbHF5VXIMJpW 1d1Iqp+xJ3irEj4TKlBwXYqJfvC0c4M1NeeyPULP+uYxDF0Z+iVSKmxMvXehk4iKDci4 2q7eCD3az3T8uRgnGP0exjD+UdI0tz9Yf9ep6ZINmSswgtpzPA0tDACVshtJuAh7ONyl hUBLq2P1MbxqCn2tn5PXub17cKTlM1p4pbsHj0yV3Tlo/BYX7ph39coV+SpwgPTDMlT2 2ZJ7Q9JF0tUf13CaSUMtT48WgrxfeIwI1eKUiQ6U8RIVFn7o3ErBcpj6jCPH91vj09bX eOhw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id dr16-20020a170907721000b007ae127fa284si3856169ejc.371.2022.11.05.13.16.50; Sat, 05 Nov 2022 13:16:51 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 06CCA68B1B3; Sat, 5 Nov 2022 22:16:41 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay8-d.mail.gandi.net (relay8-d.mail.gandi.net [217.70.183.201]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 2249868B1CE for ; Sat, 5 Nov 2022 22:16:34 +0200 (EET) Received: (Authenticated sender: michael@niedermayer.cc) by mail.gandi.net (Postfix) with ESMTPSA id 0270C1BF20A for ; Sat, 5 Nov 2022 20:16:32 +0000 (UTC) From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 5 Nov 2022 21:16:27 +0100 Message-Id: <20221105201629.1980-2-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20221105201629.1980-1-michael@niedermayer.cc> References: <20221105201629.1980-1-michael@niedermayer.cc> Subject: [FFmpeg-devel] [PATCH 2/4] avcodec/bonk: decode multiple passes in intlist_read() at once X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: CeQ/Q6rvntu+ This makes the worst case much faster Fixes: Timeout Fixes: 51363/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5660734784143360 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/bonk.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c index 409694f710..471e09fe14 100644 --- a/libavcodec/bonk.c +++ b/libavcodec/bonk.c @@ -159,6 +159,7 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part) int n_zeros = 0, step = 256, dominant = 0; int pos = 0, level = 0; BitCount *bits = s->bits; + int passes = 1; memset(buf, 0, entries * sizeof(*buf)); if (base_2_part) { @@ -222,21 +223,25 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part) x = 0; n_zeros = 0; for (i = 0; n_zeros < entries; i++) { + if (x >= max_x) + return AVERROR_INVALIDDATA; + if (pos >= entries) { pos = 0; - level += 1 << low_bits; + level += passes << low_bits; + passes = 1; + if (bits[x].bit && bits[x].count > entries - n_zeros) + passes = bits[x].count / (entries - n_zeros); } - if (x >= max_x) - return AVERROR_INVALIDDATA; - if (buf[pos] >= level) { if (bits[x].bit) - buf[pos] += 1 << low_bits; + buf[pos] += passes << low_bits; else n_zeros++; - bits[x].count--; + av_assert1(bits[x].count >= passes); + bits[x].count -= passes; x += bits[x].count == 0; }