| Message ID | 20230111235432.2135-4-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 9f0602a717c3939529bfe49734f3d8029dc36625 |
| Headers | show |
| Series | [FFmpeg-devel,1/6] avcodec/eatgq: : Check index increments in tgq_decode_block() | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
Michael Niedermayer: > Fixes: out of array access > Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGI_fuzzer-6704753329700864 > Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGI_fuzzer-6683986844057600 > Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGI_fuzzer-6697387691474944 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/sgidec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/sgidec.c b/libavcodec/sgidec.c > index 6ff2ee97f6..92083f23de 100644 > --- a/libavcodec/sgidec.c > +++ b/libavcodec/sgidec.c > @@ -159,7 +159,7 @@ static int read_uncompressed_sgi(uint8_t *const out[4], const ptrdiff_t stride[4 > unsigned rowsize = width * bytes_per_channel; > > /* Test buffer size. */ > - if (rowsize * (int64_t)height > bytestream2_get_bytes_left(g)) > + if (rowsize * (int64_t)height * nb_components > bytestream2_get_bytes_left(g)) > return AVERROR_INVALIDDATA; > > for (unsigned z = 0; z < nb_components; z++) { LGTM. (Sorry for having forgotten this in ce4713ea731b9deb0440abe8d8a2a41d2957efc5.) - Andreas
On Thu, Jan 12, 2023 at 01:02:57AM +0100, Andreas Rheinhardt wrote: > Michael Niedermayer: > > Fixes: out of array access > > Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGI_fuzzer-6704753329700864 > > Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGI_fuzzer-6683986844057600 > > Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGI_fuzzer-6697387691474944 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/sgidec.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavcodec/sgidec.c b/libavcodec/sgidec.c > > index 6ff2ee97f6..92083f23de 100644 > > --- a/libavcodec/sgidec.c > > +++ b/libavcodec/sgidec.c > > @@ -159,7 +159,7 @@ static int read_uncompressed_sgi(uint8_t *const out[4], const ptrdiff_t stride[4 > > unsigned rowsize = width * bytes_per_channel; > > > > /* Test buffer size. */ > > - if (rowsize * (int64_t)height > bytestream2_get_bytes_left(g)) > > + if (rowsize * (int64_t)height * nb_components > bytestream2_get_bytes_left(g)) > > return AVERROR_INVALIDDATA; > > > > for (unsigned z = 0; z < nb_components; z++) { > > LGTM. (Sorry for having forgotten this in > ce4713ea731b9deb0440abe8d8a2a41d2957efc5.) will apply thx [...]
diff --git a/libavcodec/sgidec.c b/libavcodec/sgidec.c index 6ff2ee97f6..92083f23de 100644 --- a/libavcodec/sgidec.c +++ b/libavcodec/sgidec.c @@ -159,7 +159,7 @@ static int read_uncompressed_sgi(uint8_t *const out[4], const ptrdiff_t stride[4 unsigned rowsize = width * bytes_per_channel; /* Test buffer size. */ - if (rowsize * (int64_t)height > bytestream2_get_bytes_left(g)) + if (rowsize * (int64_t)height * nb_components > bytestream2_get_bytes_left(g)) return AVERROR_INVALIDDATA; for (unsigned z = 0; z < nb_components; z++) {
Fixes: out of array access Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGI_fuzzer-6704753329700864 Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGI_fuzzer-6683986844057600 Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGI_fuzzer-6697387691474944 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/sgidec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)