| Message ID | 20240618134826.2189719-1-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/7] avcodec/utils: apply the same alignment to YUV410 as we do to YUV420 when motion estimation is used | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
Michael Niedermayer: > The snow encoder uses block based motion estimation which can read out of array if > insufficient alignment is used > > Fixes: out of array access > Fixes: 68963/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4979988435632128 > Fixes: 68969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6239933667803136.fuzz > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/utils.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/utils.c b/libavcodec/utils.c > index 337c00e789a..7914f799041 100644 > --- a/libavcodec/utils.c > +++ b/libavcodec/utils.c > @@ -259,6 +259,9 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height, > if (s->codec_id == AV_CODEC_ID_SVQ1) { > w_align = 64; > h_align = 64; > + } else if (s->codec_id == AV_CODEC_ID_SNOW) { > + w_align = 16; > + h_align = 16; > } > break; > case AV_PIX_FMT_RGB555: avcodec_align_dimensions2() is for decoders and happens to be used by ff_encode_alloc_frame(), too. But decoders should not be required to add more padding because the decoder needs more. Instead the encoder should add more padding itself (by using more than 2 * EDGE_WIDTH). - Andreas
diff --git a/libavcodec/utils.c b/libavcodec/utils.c index 337c00e789a..7914f799041 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -259,6 +259,9 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height, if (s->codec_id == AV_CODEC_ID_SVQ1) { w_align = 64; h_align = 64; + } else if (s->codec_id == AV_CODEC_ID_SNOW) { + w_align = 16; + h_align = 16; } break; case AV_PIX_FMT_RGB555:
The snow encoder uses block based motion estimation which can read out of array if insufficient alignment is used Fixes: out of array access Fixes: 68963/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4979988435632128 Fixes: 68969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6239933667803136.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/utils.c | 3 +++ 1 file changed, 3 insertions(+)