From patchwork Tue Dec 26 16:37:29 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 45331 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:6623:b0:194:e134:edd4 with SMTP id n35csp3137405pzh; Tue, 26 Dec 2023 08:37:45 -0800 (PST) X-Google-Smtp-Source: AGHT+IHpfDXoRFPuFb3l6zmY+ZIVwSyF1iU74afppOqRXoeT3krskRVfwL+Kc9Hpk2IPBZJE3rBJ X-Received: by 2002:a2e:2413:0:b0:2cc:9493:8117 with SMTP id k19-20020a2e2413000000b002cc94938117mr2924718ljk.65.1703608665169; Tue, 26 Dec 2023 08:37:45 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1703608665; cv=none; d=google.com; s=arc-20160816; b=iHWxBlNG/k5P1gIcFQ6vQOPrXFcSwXLOEP2fLkkZuDShzvFaTyax3ja8kXQGqkv7Ai 7L/ZWgMHDfF252L8oc8Tr+mvd+fGtSwYwyBSYN4H/VENLBzhfLZ5koIlurnvj8nNBuMN CttvtwenQ1j1vF/bomZWn1lQZh5lgzTHYIP94opAZsQ2Bxrfxu0cPDDs7yS9DOv7MMfo KiN+BCtYQFl+GbKCtrhz3BY44MPJ/tGVaknbrdAzCgwRqXaxOxgpcrmfW5Xzezez2Qii JEgeGvuyGv3xI+fRl5iLFSoEKFnf4uBkhpxuc+Vbl6i8t+1/90sC5++xcbvFVV3Zjvz3 TpdQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:message-id:date:to:from:dkim-signature :delivered-to; bh=yO2RvgBX632VLw3qiq0YjqcGksYE+FcES+XgQcjCAow=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=cElppulGp5cw3NcphQd50aZzwINudczdClhGKS5Duqo9MRylGk/vMpquJHCiTunC2U lOQZyVxewPkmV81D29ixzNX7hClhq8BIjSj4F08unsMGpRq6l+yfbtkdtRLU+qQKmWSC DBtS7QgNlLKVNkeAyQZ6neEtJnyzqUv7DzrwTW72qofZE/p99BQlyaxr4gKd9CsApwJ9 99JiKeT1AhWIbAwLC3bKxwlz5AGZx2OOa3v4d0fhS2tCpLpgOjrBaHbyhDvJHXwosBP1 yRiEA25HC0CnvcPuvXkIZSg7sOSNrqcAo+86yvjq+sDQ45KqwuBKuOcIS17UQKZ4OChH R/0Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=BIWfDTkP; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id v14-20020a50d58e000000b0054b71b1dd94si5632608edi.599.2023.12.26.08.37.43; Tue, 26 Dec 2023 08:37:45 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=BIWfDTkP; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 8EF5F68CC5D; Tue, 26 Dec 2023 18:37:39 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay6-d.mail.gandi.net (relay6-d.mail.gandi.net [217.70.183.198]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id EF33768C75E for ; Tue, 26 Dec 2023 18:37:32 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id 1FB63C0002 for ; Tue, 26 Dec 2023 16:37:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1703608652; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=lip0WZ4xXaWbDXWk9qb/QKgIQJH67818bua12ZFlQPE=; b=BIWfDTkPtPSvs65/JWh7Fe6rj5rCQ5bF1oOQm8mAj6CEaw+z3Jto5GBr9SIbaLvkT+XAMI BBcvQJUbtkQArcbM2qlVN2Tr9m6XpkQuBo0/8z7JNvX7qJpAOC3+XIol+vcVc4BsCr/clt iEUF1FVfzyAWJw5PM+KRlHAiJdl+BhKGwH1KTF12D8r7aPUWGMu75VF95Zw2F00HNxdCEX x0ouQWonsf4FlX45Su3ne8MBPK8HicztcDzkgZ5dIfwHn4XJ5N8TgsyS4RrV7Pth0W9HRi MA50pImnYQKszSlC1UvMReUh57t6+ydru6yekPixilTM78itQ4K7aVlU+cU+yQ== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Tue, 26 Dec 2023 17:37:29 +0100 Message-Id: <20231226163731.4147-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 1/3] avcodec/osq: Implement flush() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: vaTBXvX1abkW Fixes: out of array access Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6227491892887552 Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6268561729126400 Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6414805046788096 Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6538151088488448 Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6608131540779008 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/osq.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libavcodec/osq.c b/libavcodec/osq.c index 435f3ea7f69..abe15c97f18 100644 --- a/libavcodec/osq.c +++ b/libavcodec/osq.c @@ -61,6 +61,15 @@ typedef struct OSQContext { int pkt_offset; } OSQContext; +static void osq_flush(AVCodecContext *avctx) +{ + OSQContext *s = avctx->priv_data; + + s->bitstream_size = 0; + s->pkt_offset = 0; + av_packet_unref(s->pkt); +} + static av_cold int osq_close(AVCodecContext *avctx) { OSQContext *s = avctx->priv_data; @@ -478,4 +487,5 @@ const FFCodec ff_osq_decoder = { AV_SAMPLE_FMT_S16P, AV_SAMPLE_FMT_S32P, AV_SAMPLE_FMT_NONE }, + .flush = osq_flush, }; From patchwork Tue Dec 26 16:37:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 45332 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:6623:b0:194:e134:edd4 with SMTP id n35csp3137485pzh; Tue, 26 Dec 2023 08:37:53 -0800 (PST) X-Google-Smtp-Source: AGHT+IGDraIPLVl5wGLaTTE9J6RFMyD1t6wWbm03XTUp/iKUkQqgI1lOw3WXytYoyUNkFg7qUTNu X-Received: by 2002:a17:906:73db:b0:a23:5ad5:27b2 with SMTP id n27-20020a17090673db00b00a235ad527b2mr1621404ejl.212.1703608672963; Tue, 26 Dec 2023 08:37:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1703608672; cv=none; d=google.com; s=arc-20160816; b=KxxBy0aTWQESU4wdYpiw5LJsDmZxQffJjtv9B1MnxZJn/wUt3VQviXTDZ5SAmKfa98 gEjQLklgLyzscVGhYLswcTTjxMj4SX3PfoejY9OYPvyrmoT84HH7TgAP8m+yV73HNS42 rwwuT9rZhWN+uVIfjVYV1zRgqXiBcdk9X+GwGKYNbVPLpD6i4XT+UawUipvfRFPDJbyJ RlF+22zfdZVOyb6b+ENbkv5xQN8gkNMCM4pgpn9gQfJqqKfcLhw3nS6JY0zvIhfQn/hX XSgTlm6MUB5xmCX3ADFjoD/HPUM0I2g0WUMOf5JL+ypa2wyN+eoGUF2KLygUGE/0gx/8 pZAg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:dkim-signature:delivered-to; bh=KMQleyZCOPVfI/wbglmXJFr4pZq6OsT9Nof9KvcOS/U=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=fhAZ6AXhicBkdzdUP4XCM+ziwPXxzdqxi9bhPDp6SxkPg7QlyyM4VFoYCPAABYN476 vf+PhXkUmGuSnoGb/WmBxLoH4rbpgzMQtIC6gLa+60DswzL55kIDJYUXUx4XQBHVrkMi +/DlRJk2zr5Jmy4gwmJB0KwFtApaam8mPS0B+PFtplJ2NujcfPxW3SIhMncYg8gnasDK lExQU86w4nHyo3plN9OUGytQZ6dg+yWVb+lhI1owuVk8ooiW4kEIxstQnPZ4ktYb8V74 Z1mY/Xqjpyn1Cw8Ty7iAWYYQVq8sgOmN8rhtqS4mtyF/4lggxjupuckVBqviElAca7zt d0HQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=DDLHvvn3; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id um2-20020a170906cf8200b00a268eb7d6ecsi5567739ejb.672.2023.12.26.08.37.52; Tue, 26 Dec 2023 08:37:52 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=DDLHvvn3; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id A567C68CC9E; Tue, 26 Dec 2023 18:37:42 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [217.70.183.197]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id D8A8468CAD4 for ; Tue, 26 Dec 2023 18:37:33 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id 108991C0009 for ; Tue, 26 Dec 2023 16:37:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1703608653; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:in-reply-to:in-reply-to:references:references; bh=xRJJyNgFvTeWlt2s909fftoRu2YKuo7aVX5dKCjcNCQ=; b=DDLHvvn3SzGOzo5J7J6bJBcwUS1yfgUPY19UKR1gSkFep/0JIzA6IhEldM0GKZD7XWjQZX 0aodOzv1A1bg3j8fmcbaclW1/JTSaQXx2RHqa5De2nA0H4R2eLJaushpoOkj2qP4cC4yWQ u51zdhx8S1N/fyDhbfpaopOODeNbLr6KgvKe1R8KoM22Jky6z8/DjNVQyz4mdkKkXT3S53 A6evvGbuylY6ejBnvVkc4m6mJV0DjGbE8iihGhr4VtQCP4U81l6UpCRQjvSdxWG9VWzkdh zmEFjAziYxlHS9lQnNGbbFinj5oqMHsIGoonzGz2eOKsXDMUmEsY8oPQ18qhOg== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Tue, 26 Dec 2023 17:37:30 +0100 Message-Id: <20231226163731.4147-2-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20231226163731.4147-1-michael@niedermayer.cc> References: <20231226163731.4147-1-michael@niedermayer.cc> X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 2/3] avcodec/osq: avoid several signed integer overflows X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: i2r8gQzXxPh7 Fixes: signed integer overflow: 178459578 + 2009763270 cannot be represented in type 'int' Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5013423686287360 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/osq.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/libavcodec/osq.c b/libavcodec/osq.c index abe15c97f18..f2771c46eb5 100644 --- a/libavcodec/osq.c +++ b/libavcodec/osq.c @@ -222,8 +222,8 @@ static int osq_channel_parameters(AVCodecContext *avctx, int ch) #define C (-3) #define D (-4) #define E (-5) -#define P2 ((dst[A] + dst[A]) - dst[B]) -#define P3 ((dst[A] - dst[B]) * 3 + dst[C]) +#define P2 (((unsigned)dst[A] + dst[A]) - dst[B]) +#define P3 (((unsigned)dst[A] - dst[B]) * 3 + dst[C]) static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int downsample) { @@ -273,10 +273,10 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int case 0: break; case 1: - dst[n] += dst[A]; + dst[n] += (unsigned)dst[A]; break; case 2: - dst[n] += dst[A] + p; + dst[n] += (unsigned)dst[A] + p; break; case 3: dst[n] += P2; @@ -291,28 +291,28 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int dst[n] += P3 + p; break; case 7: - dst[n] += (P2 + P3) / 2 + p; + dst[n] += (int)(P2 + P3) / 2 + (unsigned)p; break; case 8: - dst[n] += (P2 + P3) / 2; + dst[n] += (int)(P2 + P3) / 2; break; case 9: - dst[n] += (P2 * 2 + P3) / 3 + p; + dst[n] += (int)(P2 * 2 + P3) / 3 + (unsigned)p; break; case 10: - dst[n] += (P2 + P3 * 2) / 3 + p; + dst[n] += (int)(P2 + P3 * 2) / 3 + (unsigned)p; break; case 11: - dst[n] += (dst[A] + dst[B]) / 2; + dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2; break; case 12: - dst[n] += dst[B]; + dst[n] += (unsigned)dst[B]; break; case 13: - dst[n] += (dst[D] + dst[B]) / 2; + dst[n] += (int)(unsigned)(dst[D] + dst[B]) / 2; break; case 14: - dst[n] += (P2 + dst[A]) / 2 + p; + dst[n] += (int)((unsigned)P2 + dst[A]) / 2 + (unsigned)p; break; default: return AVERROR_INVALIDDATA; From patchwork Tue Dec 26 16:37:31 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 45333 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:6623:b0:194:e134:edd4 with SMTP id n35csp3137575pzh; Tue, 26 Dec 2023 08:38:01 -0800 (PST) X-Google-Smtp-Source: AGHT+IGPYmtqEKj28SxeGoBJlMK67rYqFW/6WacdwxyEz7/FfrmXl13WO49RfamGPvSRhdEq2r7T X-Received: by 2002:a17:906:d189:b0:a23:58f9:e1d0 with SMTP id c9-20020a170906d18900b00a2358f9e1d0mr7784666ejz.2.1703608681590; Tue, 26 Dec 2023 08:38:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1703608681; cv=none; d=google.com; s=arc-20160816; b=MUPxTzZ3CoMgWPAmZpZgvhVBiNqqpxfXxn6qgrX1c+TuzfKo+OzIWxhkvE2O6x2/Zh BIKbnVnSb2KP0zebd/xHya6yqkrHluYX7ayOCe997P7AniCXEPt69BHaHWbN/H221EFs sNie5Olf8TkrJF2GqDzsDgGz3QU6bPjmFqDwTINpGJJE3kfjtNMA1ZVoF0gweYYniL7F 2uH0SjkuRdevpAHnol6yUJxlSFNDmyAheOhm6Ub+sZPv34QSPOR6UB8T3pw3PWTKWwAv R1EDRCgJ7CpJY/q3dKw8muRD+zpbPVY05Y3QF/b6N69HsWMOcb93CmQR5G1x+QbjIl6U p2UQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:dkim-signature:delivered-to; bh=GsAcV9ehjiW9hXDspEKapBbPoOBl6ja3INW5GzWROwY=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=zYhyCp1Iawgl4FsagbjtSHwpbNoWKhxFUnpPs2IDKgzHbCRtgv3cnr5HLaFkwgUylw WrqLxJ1qXDbRim6yT4WPg03+hosCE8umP3d12tXRad00M37auhNnkoV8IyFv4gCqJZLk ems1hYihBxkgIgn1hY9gncQ4ODHAmNLQjbe/c9n7f3TnpOCMFMgL3/MI9IPPi4KmajY5 LVvj3QaodqIOIkYa3nNIvclUs65IfVQKXtzO1/TEgdSKCCZ04ftg9sqyN0jiN+BA6aIe 6722RUB9Vbpx57+MQMBjLhI56HLpC4Ax0VdcHjkVCCudmEfTx1Q5lXLOrZ42rtmTyFIT NB1g== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=bDEGLJCS; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id kb4-20020a170907924400b00a26ab41d1bfsi2741573ejb.120.2023.12.26.08.38.00; Tue, 26 Dec 2023 08:38:01 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=bDEGLJCS; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id BD5A268CCB4; Tue, 26 Dec 2023 18:37:43 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay8-d.mail.gandi.net (relay8-d.mail.gandi.net [217.70.183.201]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C596768CC6C for ; Tue, 26 Dec 2023 18:37:34 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id EB0491BF206 for ; Tue, 26 Dec 2023 16:37:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1703608654; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:in-reply-to:in-reply-to:references:references; bh=xwkRJRs6Y8PwpLt3cmScrumn33iCYGN57OuvxpUJyHA=; b=bDEGLJCS52N7Vn8IF4G3pkhDRy6b1z62IyI64fg06z771DM+39WAsDo+KdV6dpZWLnI8SA YbvbwFmQpk52qho8C7vQLDnqcl/7zWdTF16igfYFiKTC6wc0KdtS2LqM6QCxi+63Yk7hds 6Mf/RgpMaC2WVsEhLp8rj5Pq8I52WDR6VuFRWhagLWdPRVQANdT/932OYurMbenFAayzzd n/vZVBFiwL9DmQV1JJsXclzIk5q8kPnftWLcNNpTUyRiBaJn8qr9UVZWzVJ5vhHPeSEp7N o7kcUefG3JLdA79ch/cdby73hBHyA3HEnxfvCAuUL5FHkYlO4o5aN3nCVr8qVQ== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Tue, 26 Dec 2023 17:37:31 +0100 Message-Id: <20231226163731.4147-3-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20231226163731.4147-1-michael@niedermayer.cc> References: <20231226163731.4147-1-michael@niedermayer.cc> X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 3/3] avformat/concatdec: clip outpoint - inpoint overflow in get_best_effort_duration() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: E4kiG1QBPQmc An alternative would be to limit all time/duration fields to below 64bit Fixes: signed integer overflow: -93000000 - 9223372036839000000 cannot be represented in type 'long long' Fixes: 64546/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5110813828186112 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/concatdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c index 5a7a063ef7d..3da2ac9e705 100644 --- a/libavformat/concatdec.c +++ b/libavformat/concatdec.c @@ -323,7 +323,7 @@ static int64_t get_best_effort_duration(ConcatFile *file, AVFormatContext *avf) if (file->user_duration != AV_NOPTS_VALUE) return file->user_duration; if (file->outpoint != AV_NOPTS_VALUE) - return file->outpoint - file->file_inpoint; + return av_sat_sub64(file->outpoint, file->file_inpoint); if (avf->duration > 0) return avf->duration - (file->file_inpoint - file->file_start_time); if (file->next_dts != AV_NOPTS_VALUE)