From patchwork Tue Aug 20 07:50:55 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 51089 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:612c:40de:b0:48e:c0f8:d0de with SMTP id lb30csp137397vqb; Tue, 20 Aug 2024 01:01:23 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWWT9CP4j5oAzRqhoCiXyPN7RBLNkdPnJgVASrEUYcm6XWhS+LXCfcoIXV9XFUF+Qd2ugvSni7x1475nTdKrvBYhpKWrrahmsCHXA== X-Google-Smtp-Source: AGHT+IEyVj0jy/4VR73edvSOXTkXBQJeyld2NSPl3va3quvgoPu1ve1UuNqU3NCFmTyhfnjJDz8g X-Received: by 2002:a17:907:f1e5:b0:a72:8d2f:859c with SMTP id a640c23a62f3a-a83929547bbmr892347066b.33.1724140883012; Tue, 20 Aug 2024 01:01:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1724140882; cv=none; d=google.com; s=arc-20160816; b=fbq94Cz65jgx9mHGRALqS1I5QkBNeIoLapc4cdxD1QiSKuVLXNFetpbt5A5EiBWSo4 MRiE4Y4+gcDG0NF0a/Op3bVKWfL/dGStFMkB2VG47MtFpEsFt+5I5NIhxAcavV7KPjAJ Mm+xygWOMNS6P6SQuVXWGCdQiDGScIo1wsbdgzmCmamF6LkLhYyq3lenvfMVQf0869gh zfY2ucYh44h5++ZOjO1lGa1GoiKl6/LZCgEWrgV9YXAVatZFvVPDj9lJDhUt7hXqT/NT 6HPzNB6WxhSRfgK1K0jooLS8CBgyUcUWBykVtW5CYumqZaIBOuGfqeMzaTElyIGDGNxn R8EA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:references:in-reply-to:message-id :date:to:from:dkim-signature:delivered-to; bh=20z2MiYAiH5r5u57fXMi6iWM9S0A1ViimVxumPYy/LM=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=BK8cpqvPQllVm89QPFBIcW8xB4/rCw4r/z9sDbSXeNPTijOrCrryWeFlbKtEwgZzcK dUMrrHLvjFpuOiylBPqpfm+jh9EXspqKJhXZpa6uMzuK/VdUDUQY2E5UDhrsg4X+KQ+9 IvBRc/NspCH1vgttgVHI0sOCahk4Lp9W8uqoczl7v7ww3EeB4BimeUFN6AKi9zPPnYzZ 2DbxRXLJydIMPhWgtXy3qf2wx3oRz/PF6dtz6pG/nXNjiUXT23jI9qmsbOHDEyD2l7H5 KMKNzhZu2iN+ItwROuFvRjBvGuFf3dOvE+Kjp5rizGqcHljS/q5R6DolTghK6uHaw9M4 d5+Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b="N/a23fHy"; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id a640c23a62f3a-a838394a9f1si645444266b.563.2024.08.20.01.01.22; Tue, 20 Aug 2024 01:01:22 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b="N/a23fHy"; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 4C30468DC91; Tue, 20 Aug 2024 10:51:11 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay8-d.mail.gandi.net (relay8-d.mail.gandi.net [217.70.183.201]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 7FA6F68DB76 for ; Tue, 20 Aug 2024 10:51:02 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id BBC541BF20B for ; Tue, 20 Aug 2024 07:51:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1724140261; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=a2jSKpEYIrAKKif47YMRrPK8kmNtfGOYHwfL0oCs5xw=; b=N/a23fHyGQTjzf5KFyPo+phNliwXi/vocRDxuSW2PQc+XYv0JqHJwAdCf2Hz0gKPjywOOY b9SojzDCTTvUZhLAjc4RMF0N1USjMQEJhqCTaIEoKDTlNuie98QbvGZW/TrHApxsqJmYgs sPHArR41civbazMBNqSNig9GgDpOQc2Rlzf2vNPQACvX5fksQ46tcvDXHv82+NAHOX+o9d eScB5IZD48aqAV+Oihcol9/eJcy4VCrTMUexzIfJ1TPhgAtXj4LbKJlHmwpunxZZlgaIDW gCwIxEe1EAfHm0Rf3xi6xUC4mw+6uAHid1cvTBdq9iPvBU4S7JegM6jrx8vrAA== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Tue, 20 Aug 2024 09:50:55 +0200 Message-ID: <20240820075057.1735944-4-michael@niedermayer.cc> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20240820075057.1735944-1-michael@niedermayer.cc> References: <20240820075057.1735944-1-michael@niedermayer.cc> MIME-Version: 1.0 X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 4/6] avcodec/notchlc: Check bytes left before reading X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: Cby4deCFdW/U Fixes: Use of uninitialized value Fixes: 71230/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-4624502095413248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/notchlc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/notchlc.c b/libavcodec/notchlc.c index 371c8b5e54c..246a3e0174d 100644 --- a/libavcodec/notchlc.c +++ b/libavcodec/notchlc.c @@ -93,6 +93,9 @@ static int lz4_decompress(AVCodecContext *avctx, } while (current == 255); } + if (bytestream2_get_bytes_left(gb) < num_literals) + return AVERROR_INVALIDDATA; + if (pos + num_literals < HISTORY_SIZE) { bytestream2_get_buffer(gb, history + pos, num_literals); pos += num_literals;