From patchwork Sun Apr 23 22:32:36 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 41308 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:dca6:b0:f3:34fa:f187 with SMTP id ky38csp1041265pzb; Sun, 23 Apr 2023 15:33:33 -0700 (PDT) X-Google-Smtp-Source: AKy350ZhlMb5lIYqH5qeceCDrKGeVdfmud7DtMj02szBdek4kLPvLhwJ4WyxlHEGQbxlse5Bjs+9 X-Received: by 2002:aa7:de92:0:b0:504:a2c8:ea60 with SMTP id j18-20020aa7de92000000b00504a2c8ea60mr10146081edv.35.1682289213003; Sun, 23 Apr 2023 15:33:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1682289212; cv=none; d=google.com; s=arc-20160816; b=ABWSOrPuSmzjYdzYdLHDQNaOMItifRnDX+kEicWi030Bs0dKEnwPL94hxYoQiga8K8 oux0Hb3JcN3TAuoJgOdLgv7RafeUUBAmrMNWLssn9P5ytlHDJUVfV5QSWmihOwF2G+rG KUpEwsSwlzorE6ghLiXQ9M9NcipBTDb9a7kpFhCRlsYZPNXqohRV/nmNnsGtE46vxTix 4JJMqyfk20gvRuuF3o9rMg3qlA6ktWanivHt73fC2F9njlwFMtjPEG9kWLCigpa58qyK 9Oo1P5Y+C2BkT5zCnC3g97VhgKWoGRt7nOWkiIl62xf18ujjup4LFTrv2+pVRPSrrZB0 asQA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:delivered-to; bh=TmMhy0JNW6ihoJ52a2F3DOkeJhk+/LelCSZEAFXX9Ps=; b=IJEa3zMG+OqHZkvS8GsdhbMxxji6Z8lbgbzCW+WL4byIXMFwjFLs7rOq91OHmE1jD+ KM2wCCVE+lqPl7gp4UVabJY80K5eXtx6sNKaTaixaN82Tn21HTx1IW/BCs5BuU5laLMX 3ORvAq7pcluWQYVYPqUGBPwR0CuOGUr8Rbkv6CAXhimQr25jvAEaH4IMHoMwx9pdyXV7 rvfQK7rO/l+9RDDaX+ydqO9Kg3AOJQPsYEiUXLHAb/GBDzm5gZ7mkU/HmuvvLFsRc/kr kw+nKJJEshdruILF+jRZwdqod1+xIyrt+w8CC8KbCRx2jTr/JLMd48rRLKm81/d7nbmy /8/Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id q10-20020aa7cc0a000000b005068286d9e8si7401064edt.509.2023.04.23.15.33.32; Sun, 23 Apr 2023 15:33:32 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 90AFD68BF95; Mon, 24 Apr 2023 01:32:51 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 44B1D68BF84 for ; Mon, 24 Apr 2023 01:32:43 +0300 (EEST) Received: (Authenticated sender: michael@niedermayer.cc) by mail.gandi.net (Postfix) with ESMTPSA id 9325DE0006 for ; Sun, 23 Apr 2023 22:32:42 +0000 (UTC) From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Mon, 24 Apr 2023 00:32:36 +0200 Message-Id: <20230423223236.375-6-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230423223236.375-1-michael@niedermayer.cc> References: <20230423223236.375-1-michael@niedermayer.cc> Subject: [FFmpeg-devel] [PATCH 6/6] avcodec/bonk: decode multiple passes in intlist_read() at once X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: FDkQuRpyBVkC This makes the worst case much faster Fixes: Timeout Fixes: 51363/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5660734784143360 Fixes: 57957/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5874095467397120 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/bonk.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c index 5f510e4910..4a00270392 100644 --- a/libavcodec/bonk.c +++ b/libavcodec/bonk.c @@ -155,6 +155,7 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part) int n_zeros = 0, step = 256, dominant = 0; int pos = 0, level = 0; BitCount *bits = s->bits; + int passes = 1; memset(buf, 0, entries * sizeof(*buf)); if (base_2_part) { @@ -216,24 +217,28 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part) x = 0; n_zeros = 0; for (i = 0; n_zeros < entries; i++) { + if (x >= max_x) + return AVERROR_INVALIDDATA; + if (pos >= entries) { pos = 0; - level += 1 << low_bits; + level += passes << low_bits; + passes = 1; + if (bits[x].bit && bits[x].count > entries - n_zeros) + passes = bits[x].count / (entries - n_zeros); } if (level > 1 << 16) return AVERROR_INVALIDDATA; - if (x >= max_x) - return AVERROR_INVALIDDATA; - if (buf[pos] >= level) { if (bits[x].bit) - buf[pos] += 1 << low_bits; + buf[pos] += passes << low_bits; else n_zeros++; - bits[x].count--; + av_assert1(bits[x].count >= passes); + bits[x].count -= passes; x += bits[x].count == 0; }