| Message ID | 20221127223435.8362-2-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | a9d15d43eb0f976b982bf2ad6ec1d8ac084c7ded |
| Headers | show |
| Series | [FFmpeg-devel,1/3] avcodec/mpeg12dec: Check input size | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Sun, Nov 27, 2022 at 11:34:34PM +0100, Michael Niedermayer wrote: > Various parts of the code assume that width can be divided by various powers of 2 > without rounding > > Fixes: out of array access > Fixes: 53623/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQC_fuzzer-6209269924233216 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/vqcdec.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/vqcdec.c b/libavcodec/vqcdec.c > index 18cd99462e..c3bce87974 100644 > --- a/libavcodec/vqcdec.c > +++ b/libavcodec/vqcdec.c > @@ -71,6 +71,9 @@ static av_cold int vqc_decode_init(AVCodecContext * avctx) > static AVOnce init_static_once = AV_ONCE_INIT; > VqcContext *s = avctx->priv_data; > > + if (avctx->width & 15) > + return AVERROR_PATCHWELCOME; > + > s->vectors = av_malloc((avctx->width * avctx->height * 3) / 2); > if (!s->vectors) > return AVERROR(ENOMEM); > -- > 2.17.1 ok. please apply. -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
On Thu, Dec 08, 2022 at 06:32:40PM +1100, Peter Ross wrote: > On Sun, Nov 27, 2022 at 11:34:34PM +0100, Michael Niedermayer wrote: > > Various parts of the code assume that width can be divided by various powers of 2 > > without rounding > > > > Fixes: out of array access > > Fixes: 53623/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQC_fuzzer-6209269924233216 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/vqcdec.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/libavcodec/vqcdec.c b/libavcodec/vqcdec.c > > index 18cd99462e..c3bce87974 100644 > > --- a/libavcodec/vqcdec.c > > +++ b/libavcodec/vqcdec.c > > @@ -71,6 +71,9 @@ static av_cold int vqc_decode_init(AVCodecContext * avctx) > > static AVOnce init_static_once = AV_ONCE_INIT; > > VqcContext *s = avctx->priv_data; > > > > + if (avctx->width & 15) > > + return AVERROR_PATCHWELCOME; > > + > > s->vectors = av_malloc((avctx->width * avctx->height * 3) / 2); > > if (!s->vectors) > > return AVERROR(ENOMEM); > > -- > > 2.17.1 > > ok. please apply. will apply thx [...]
diff --git a/libavcodec/vqcdec.c b/libavcodec/vqcdec.c index 18cd99462e..c3bce87974 100644 --- a/libavcodec/vqcdec.c +++ b/libavcodec/vqcdec.c @@ -71,6 +71,9 @@ static av_cold int vqc_decode_init(AVCodecContext * avctx) static AVOnce init_static_once = AV_ONCE_INIT; VqcContext *s = avctx->priv_data; + if (avctx->width & 15) + return AVERROR_PATCHWELCOME; + s->vectors = av_malloc((avctx->width * avctx->height * 3) / 2); if (!s->vectors) return AVERROR(ENOMEM);
Various parts of the code assume that width can be divided by various powers of 2 without rounding Fixes: out of array access Fixes: 53623/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQC_fuzzer-6209269924233216 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/vqcdec.c | 3 +++ 1 file changed, 3 insertions(+)