From patchwork Fri Apr 26 23:52:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 48278 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a21:1509:b0:1a9:af23:56c1 with SMTP id nq9csp698038pzb; Fri, 26 Apr 2024 16:52:26 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVKA3TWEjVOFk85bSJ6bmSR951tAA7qonhUr92Oik815foebMmZA6VogGqF3nuTfUUKepNr2ant0XJ++U/XPp0m6RSGVNycdKCSiw== X-Google-Smtp-Source: AGHT+IFShuU+oGsLzxGrfQ/oYP/YuTssHHtKhYMeoeOmVmRR0woW7TKXo3hU7SYu1WEWFR3m4C3N X-Received: by 2002:a05:6402:5309:b0:572:65f7:eed0 with SMTP id eo9-20020a056402530900b0057265f7eed0mr1080580edb.0.1714175545758; Fri, 26 Apr 2024 16:52:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1714175545; cv=none; d=google.com; s=arc-20160816; b=lyMiDjkhqzI2Xka3v14qyNEy5I4qjDa99QNl7DUOm0oVmZWV3jhzOL+c1Kj2pj10kz slBtpNgUUap/AvGyLw1U/NvR6Bp/+bZVpvtQx4Xp7jKorRy26l0aJzlXgKygOWZlkvZu 3+VoJD7BGpUmR3J1U6UjtXgQa2k+h6FzjH9utJ2OA4rrVJ75z6jsyNXX2ndB6X6L8Del LCUzFps8AAE/F5vDQcGPwU9ghQRjAymUaqdOn4dVQVd9GT62VULbKvrSXN5ShuI40MPR LuHZFx1rj6Zq1thEOB6h9yk23Fb9ZprSZQxORjVsZaSR9NmC+egpvWKb3be+eTg0v/3j Jkwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:message-id:date:to:from :dkim-signature:delivered-to; bh=n4OAMWEfkhU/IKsZdMLpIkFSFzBn0P1Xk1zTLUccjNg=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=eX23mASQJEztXOjVpZWlw6Zaq8XNsmFyJaRNnqFnS+L91bSBmCqujL3bXhLrBdeRAa 3m6dlIO6veIyOyMKx1MDcP93UFbVrP4EDUOcddlGNZ9VFpQiWfo/2t0Z6NYd5Ww9/l8m YqmgKzPRp0AQEM7yxZFpnPGOtn2Udc/xkI/U7p0VoXMimEori/H4f2dEyZYaFi2667Xm pThirAQ/aFyUeTNMXAVg1HyBwC2AItyHX/dHRWOLzusg0ZXTnCszIbyY8ObAxSV8WRjz 8m2G+wwhpNQZGPtnolH3mm+R04i9oM6+yxNDTgff/DFdHChWr2tD8HR5CiHwRYP0akvr N87Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=KuXBs5Nu; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id s16-20020a50d490000000b0057247cf575esi1877488edi.611.2024.04.26.16.52.25; Fri, 26 Apr 2024 16:52:25 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=KuXBs5Nu; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 7D32968CF47; Sat, 27 Apr 2024 02:52:20 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay1-d.mail.gandi.net (relay1-d.mail.gandi.net [217.70.183.193]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 20FA968CD5C for ; Sat, 27 Apr 2024 02:52:12 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 0DBCC240002 for ; Fri, 26 Apr 2024 23:52:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1714175532; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=0WeOXuYYwuPsVnrFPhZ8CZGNTwRpF/98Bqxkmax47xA=; b=KuXBs5NuHMSzGXlgSKpE0Lt4RWOwdOwRiuCxvsvpaQQ6lnJOlh/3Tla3H5TdPN14vmDpA+ b3ql6lWPMIwap/r2+8u5DLDSVqXeMcZWGNeynSB3uP8zY16c76u9JkU1uS3K2xImD1QSCu Sq6WbnsSUhsbAt3jGHvhXHkTF+rt9x2itLelp8v8V/56SUh51IlaxNDss68mTIs8a0XgZN nxO1GchaRrGNVe/aqyAErXBNUOAqaOGjxrVZcnyunZ4lWkx4mkyOxxYs7auMtIgpvrdGPs ImfSxHbi7aG9tW5EKFYrIrGZ0qEDhVrYUYAuw1acThc+RXmzy60Cq+vYCPCoFw== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 27 Apr 2024 01:52:07 +0200 Message-ID: <20240426235211.3718252-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.43.2 MIME-Version: 1.0 X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 1/5] avcodec/pngdec: Check last AVFrame before deref X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: Rn+rz9qy8JYX Fixes: NULL pointer dereference Fixes: 68184/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4926478069334016 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/pngdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index f7751223b81..b24bfa248dc 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -1218,7 +1218,7 @@ static int decode_fctl_chunk(AVCodecContext *avctx, PNGDecContext *s, return AVERROR_INVALIDDATA; } - if ((sequence_number == 0 || !s->last_picture.f->data[0]) && + if ((sequence_number == 0 || !s->last_picture.f || !s->last_picture.f->data[0]) && dispose_op == APNG_DISPOSE_OP_PREVIOUS) { // No previous frame to revert to for the first frame // Spec says to just treat it as a APNG_DISPOSE_OP_BACKGROUND From patchwork Fri Apr 26 23:52:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 48279 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a21:1509:b0:1a9:af23:56c1 with SMTP id nq9csp698105pzb; Fri, 26 Apr 2024 16:52:38 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWGUEn7SifCj0/MFuLE8rTgYulKA/WXDZYIQkqMe7/JlpDYHdeK9rwdwPK18ZRSptFNXTRaLk03bAPvPbEpMNewVpCYKLEiL78Z6Q== X-Google-Smtp-Source: AGHT+IHnqHfD51GjWKgXkJ5s+gza2iT7Ruy4mPCx5VC9Z/fyQoW/Id8QGsBN5qdqqmgoKCOkQRqH X-Received: by 2002:ac2:53ae:0:b0:519:8963:c678 with SMTP id j14-20020ac253ae000000b005198963c678mr2306442lfh.23.1714175557710; Fri, 26 Apr 2024 16:52:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1714175557; cv=none; d=google.com; s=arc-20160816; b=VSk15DWidOWeMkDPZ4vb9KmItpZ2prK2gPm/eZVXPEJtlZHYm7BvldeoQwTM/BKsgf 8rbtBu3ToH5vPD1dQaWF29CrNcbiMPeIWNHDvLqvhRZQ25sNRG2zH9IiqVzNdibbNbLF WRKCa8PLUZYlJjQmQZi5wASXwQa2jikQJdjPZ4ZtIRQxDNBSKX98BaPI8MJ+C+Ubwxv0 1Iq0MDwlaMVYjGp6i1Gs0YaKCzdiQtcz5UTksRzGUb1EgjXajQBUyjEudcuHq+DidxSt EbREeIS6yipuZ6i/YG/BU+Fb9wN0zVKara0T/eHBow/ALyMtEPeWmIv6GaWKtiaTk9LI FohQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:references:in-reply-to:message-id :date:to:from:dkim-signature:delivered-to; bh=yFHRC6z37zeKGwMPos+q7ANXD3pvj3PKeRY6OGBUDWI=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=zUuxk25PxXokIcoMCvP1y8Xfkw+DSmQlDc/DAPBzhhLce++K1/3+stc7cs5h/zxQ7h xyvUJ1ens+LyJgWYWMw3ZwPG7+vBJML6YVYDAZGI+46va3UPm/LvypsTc3zXLZJom0Vi JKkLhGjC1Q9AseOncF1Ah9/5g7O8FkpAZ8bJwjgmEwaHi2ZfhHh4dPEGMWe9mm9NEjZn aDwP6D4iJ0Hw3wLlEu43+qHIYClD5+cHPlIBKsIo3O2bqZ8vnWRRFvLneB11rxYJF+wt 0tKEoUCFVgwNovZJ+CcJEk2vwkTtwnbvorE+gr1kIlNZnk+PMIO0ZN5BjOkG9OT8768W DBdQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=OWFV6vEM; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id bh14-20020a170906a0ce00b00a5251259724si11177237ejb.799.2024.04.26.16.52.37; Fri, 26 Apr 2024 16:52:37 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=OWFV6vEM; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 128CE68D3F4; Sat, 27 Apr 2024 02:52:23 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay7-d.mail.gandi.net (relay7-d.mail.gandi.net [217.70.183.200]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E513768CD5C for ; Sat, 27 Apr 2024 02:52:13 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 2ABC720002 for ; Fri, 26 Apr 2024 23:52:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1714175533; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hTaqY8EjLkMAY3ys6jabQi12fq8Bf1IZ3MIw45VZHhU=; b=OWFV6vEMJCIz88xAWIVxlNMypWZPo5cUv+3NIVeQE1vjYMjyKV983VM8NI6OI8Z7mFpIHf 1RgPCP2CUlD9OTv/CZNs3kREbwKkbE59dkzpiEgHU8VuHM8KaTV4b6RJJhJbmagAydJ10K U5m2DBlIKGfZqdVwVDuYWnlAQGaiWjOaMNKQ7rS5+MmEtPTQA6GfS3xXz2qq1pTkbrvSSG c9pEoAz8u8Vw2K3N/eOkm3SfxBMKpBsojt6gCvEhbUgiP0ZaBQevqnnuoWIY+iCkA5Vf4Y z64QrgN17kzQ44deiK0gp46NYPW8JRVV+EuEFMDVKxEtYRGgYxplkP7sECt9ZQ== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 27 Apr 2024 01:52:08 +0200 Message-ID: <20240426235211.3718252-2-michael@niedermayer.cc> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240426235211.3718252-1-michael@niedermayer.cc> References: <20240426235211.3718252-1-michael@niedermayer.cc> MIME-Version: 1.0 X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 2/5] avcodec/vp3: Call ff_progress_frame_unref() before ff_progress_frame_get_buffer() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: lBR2Ang4nGMC Fixes: Assertion !f->f && !f->progress failed at libavcodec/decode.c:1688 Fixes: 68190/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5942090287611904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/vp3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c index 2a5f68dfa8e..09527607767 100644 --- a/libavcodec/vp3.c +++ b/libavcodec/vp3.c @@ -2651,6 +2651,7 @@ static int vp3_decode_frame(AVCodecContext *avctx, AVFrame *frame, if (avctx->skip_frame >= AVDISCARD_NONKEY && !s->keyframe) return buf_size; + ff_progress_frame_unref(&s->current_frame); ret = ff_progress_frame_get_buffer(avctx, &s->current_frame, AV_GET_BUFFER_FLAG_REF); if (ret < 0) { From patchwork Fri Apr 26 23:52:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 48280 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a21:1509:b0:1a9:af23:56c1 with SMTP id nq9csp698156pzb; Fri, 26 Apr 2024 16:52:47 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVvIhdCZSZhF9ohSXHu0ETizpg4DE+sNV1iTvbtFM4eYY6uHPzavkHyY6uEPhU9BOkpGObCEaCUbN/LkAubiOAsO5alC5n4h5tyuQ== X-Google-Smtp-Source: AGHT+IF8GESpJ+JNQDU82nK9H+P3lA/yXa06OCXvLoNHT7qdxiAxrYDoI+C1RqykoouTElfTjMx+ X-Received: by 2002:aa7:c892:0:b0:56e:34e0:4699 with SMTP id p18-20020aa7c892000000b0056e34e04699mr2508619eds.30.1714175566828; Fri, 26 Apr 2024 16:52:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1714175566; cv=none; d=google.com; s=arc-20160816; b=rdZ8O7+Ka6k482Sdj11xP1oFEKc9KsBqaBLQw6106FshTrw77X6qt0a3NRqdUxjOt2 wIdqMB6P8WCoL07Ti0iO3Hv9ZaLsmVS58aIwKbOuM6gJSNLaIa3XXKyipoYuW+assXkj coEoUn/ec9/j4ulys8HUidp1hSfq2bzLEZ/qcIItcCgQVdEx7PXQs0k0n5jakmQLS5yI +wgOHxwcXuLYm3FUoP0Fy0KmVysl/k1gAkNLer8ORPXL+QenWybBugQENVC2lmafd9CC +LEU0mdQj4ZKZt81fYOYsdP3sV1lPF8fREacB2JDiNvVa6w+9Wzcb5Vxs6vGQ4VcsFUT qZkA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:references:in-reply-to:message-id :date:to:from:dkim-signature:delivered-to; bh=9QGEDcvrziyUP4xMNc9GLJhiwL3cQXbqx/REjx6ux+k=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=DS2VMRn4ljGL8aX7qLPwJruLnN8XiTXDWChX6WENKFMnRY/8ram0rwiDM0Jqy5n+5O rWUddjxB8EQcfZgxLzj9VnjbcfRR329bm2tyWruxCh9JefBR7bhiqphZzaVHNNWnOWOg /8TJmPq0cbcoZvlpcMh0TySTfdQbOwKa3tb1QmRVJaFjK75GEYL+mUEEkYk8R3Cphu1L bHx8ddDdSby78cpNNHfZNctUXviLeI0E3rufxPlD6m45qz2wa4oHg2qfX4EGXMvc42PV 20XFRW6c11LhIi+xGuadfB1f25gEsbNmCBNDxpLVJ+oaB+6U2/HuYRuiHqoRPjy/m5qb Lelw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=gQPz+xFN; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id q6-20020a056402518600b0056df9d6b14asi12469932edd.442.2024.04.26.16.52.46; Fri, 26 Apr 2024 16:52:46 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=gQPz+xFN; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 2A0EC68D17F; Sat, 27 Apr 2024 02:52:24 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [217.70.183.197]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E6B5768CD5C for ; Sat, 27 Apr 2024 02:52:14 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 2C02E1C0003 for ; Fri, 26 Apr 2024 23:52:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1714175534; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=sTtT45sh7fncmcCB/C1WbGJskz5sYdZE1fhc86qdBg8=; b=gQPz+xFNUAbYL8U6vyUgvA3pjmcQhMqvyZAYTRl2WFS3cRYC68KPJF1un7Ydl/dAAkjerp RPoBNV9VP6/KfnMDmgnlVXhTfQJCnRudv5PCB3XVh3ljGv9buaIbbAExq2/g3MJRAi5t9E Bdilf5qtiQxk02UOfNzY8l9edGMEymdaaPIyFSgwUXvRS/kPTtm248O/32HqggCX0AYHuU dhJjLcQ0Y8kNkfSxetjcBzmcZ6U1KsIvsrAbSJRbhPWNyLnA9zbEUunsRNX4h7GjPVld+n sYEpMSkZQS9EP9FzOSivnQjewhyFwuw5p9JqCNW90RsJZo+jEIdKtkBQOtCxKQ== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 27 Apr 2024 01:52:09 +0200 Message-ID: <20240426235211.3718252-3-michael@niedermayer.cc> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240426235211.3718252-1-michael@niedermayer.cc> References: <20240426235211.3718252-1-michael@niedermayer.cc> MIME-Version: 1.0 X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 3/5] avcodec/decode: Check progress before dereferencing X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: vA7N1YGWgeDx Fixes: NULL pointer dereference Fixes: 68192/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP8_fuzzer-6180311026171904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/decode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/decode.c b/libavcodec/decode.c index d031b1ca176..a6131941f43 100644 --- a/libavcodec/decode.c +++ b/libavcodec/decode.c @@ -1744,6 +1744,8 @@ void ff_progress_frame_report(ProgressFrame *f, int n) void ff_progress_frame_await(const ProgressFrame *f, int n) { + if (!f->progress) + return; ff_thread_progress_await(&f->progress->progress, n); } From patchwork Fri Apr 26 23:52:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 48281 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a21:1509:b0:1a9:af23:56c1 with SMTP id nq9csp698200pzb; Fri, 26 Apr 2024 16:52:56 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCU48j3yEJISH+Gn2z3QTx9FrsfJXRMzWFveR11QJiUbgxVhU4h9GCgKVlqYz3OFd+igma1Zz45823Z0a34wctvNM83AJ4bjew4+1A== X-Google-Smtp-Source: AGHT+IHAY/a6bWydgryoU/O7OhipGpJXGQ7uSxQEfxVxAXOgJMYj88ug7hrmwiHaDyIoC0z9wgQC X-Received: by 2002:a17:907:807:b0:a58:c551:4ed1 with SMTP id wv7-20020a170907080700b00a58c5514ed1mr3196068ejb.4.1714175576630; Fri, 26 Apr 2024 16:52:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1714175576; cv=none; d=google.com; s=arc-20160816; b=e+ELmBp86gXmX2EUzeS2o6nflycpCx7jTrOhvdZvZEtdMWMM3+jqEJL0UTNA3mny/n rPU0q/EST/DDU0jCKP3zGWrOkUO/DqclbJHbJaIHNhL1g9YZiiE8qODCseiP3gDJ8RhQ S3keMZibN3UYaWJ0eubLjiVENh7DrsYO/eWPHHwjIoQpGPJvE+UaIGXToKfYmoagYTmk cITEnQbB6Giv9RRUfHZ+/3NsxYugZ+BafjdMHDR7syI5vbWjxLfhy37GHQ42IWUkyW6y BPr1Pcvnwf1qjbyiBprptOcIt3X84lAGFLfvQfkQLR8/RGua6uTJV/QbsJ2DYo29g7Wy qjrw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:references:in-reply-to:message-id :date:to:from:dkim-signature:delivered-to; bh=ZbLB8x7Vx1sdIsQer3DIRLbTw/JySTFMjBpOt+JV+3s=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=VM5SYOZZSZDLwcdUfc+d3OHwKHgwAjZHlPIzwlxIGdz+c/426X6LUoM4Yew8NF3U+l ikd1cxMC0kwNX6s99w1LTgi14AT7pJx79K0bNNBTtC8MFDUFD76qi4A6jgB63rEtWshH PtL9nLGKPJr+4rr7G9bJgeh7TUZ0K48iPJoJvLxAcXcvsI1UpSachvqAFhFAA4Eu4c4u VwJAWm0phif8Dx5Xn//v0y9ou7sbdQJdK2LnMsfdXS+GEx3Yj005xLBDlItyJBWcJBW+ OM3ojS33UohRVk9KHjyKQcQtlLECgurtA5UbZeR9HCdQG3E4FQGarSXyHoH+xTc3dbrw v3cw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=TiGd8+k5; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id cw9-20020a170906c78900b00a58c567915bsi1533214ejb.417.2024.04.26.16.52.55; Fri, 26 Apr 2024 16:52:56 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=TiGd8+k5; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 19A6968CD5C; Sat, 27 Apr 2024 02:52:25 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay6-d.mail.gandi.net (relay6-d.mail.gandi.net [217.70.183.198]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id D440B68D3D1 for ; Sat, 27 Apr 2024 02:52:15 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 37971C0003 for ; Fri, 26 Apr 2024 23:52:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1714175535; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=lqp6to+R0iYasQcTgEkOSB3lWMIScsBAm7jrgVaMkUE=; b=TiGd8+k5xs2IgIgKAIjUiqlZ4ssm86kxCQeaR2kSWkjb1qZtrDXFKcWES0IJF1aqVjlz0K UlKK7yE/NQ77RgT1Lce9iJaZDFgyph6qh1OlYQeTl0tOSV0RXU5jTUbCoseE0XdWrY6NFT CWP1nUtVnH06u2CXOZIJGn5pEliICNwGpJsgGRdHAE55hewPKE1NjiHfCMIOtRnbrR40VM tb9jPYDLpfYPlZMActnRaFc6jRGZtEP5FgLJo++mWtOgosYBDZfYn+Lb3UDTMG+MlEMh+P blbSb0pQVX8cgVEXZ4+U6hDW627SvL6BpYoTBBjIcwN02nUu8osvJKoqf03xFA== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 27 Apr 2024 01:52:10 +0200 Message-ID: <20240426235211.3718252-4-michael@niedermayer.cc> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240426235211.3718252-1-michael@niedermayer.cc> References: <20240426235211.3718252-1-michael@niedermayer.cc> MIME-Version: 1.0 X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 4/5] avcodec/hevcdec: Check ref frame X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: JfsjjxW91z5k Fixes: NULL pointer dereferences Fixes: 68197/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6382538823106560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/hevcdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c index fcfb275f63a..92b0e45eee0 100644 --- a/libavcodec/hevcdec.c +++ b/libavcodec/hevcdec.c @@ -1969,13 +1969,13 @@ static void hls_prediction_unit(HEVCLocalContext *lc, int x0, int y0, if (current_mv.pred_flag & PF_L0) { ref0 = refPicList[0].ref[current_mv.ref_idx[0]]; - if (!ref0 || !ref0->frame->data[0]) + if (!ref0 || !ref0->frame || !ref0->frame->data[0]) return; hevc_await_progress(s, ref0, ¤t_mv.mv[0], y0, nPbH); } if (current_mv.pred_flag & PF_L1) { ref1 = refPicList[1].ref[current_mv.ref_idx[1]]; - if (!ref1 || !ref1->frame->data[0]) + if (!ref1 || !ref1->frame || !ref1->frame->data[0]) return; hevc_await_progress(s, ref1, ¤t_mv.mv[1], y0, nPbH); } From patchwork Fri Apr 26 23:52:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 48282 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a21:1509:b0:1a9:af23:56c1 with SMTP id nq9csp698247pzb; Fri, 26 Apr 2024 16:53:06 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXwuCn+uh2qyfKG8SLHb0rTk6LJMvip8AkOeKgSA8DFbnxCzwxFVsRUrbsSW+gTv5sqlsFXbP0t60KjdJRpiT22gQrpU/CcfqCHZw== X-Google-Smtp-Source: AGHT+IF2OH6bCqBL1nCbB2UrnEIfS2wSagUnSapx3cqwVzvzZGtY87UtURsWZlRvPIFE+4OcgIu0 X-Received: by 2002:adf:e70b:0:b0:34c:5f6e:1720 with SMTP id c11-20020adfe70b000000b0034c5f6e1720mr726868wrm.60.1714175585952; Fri, 26 Apr 2024 16:53:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1714175585; cv=none; d=google.com; s=arc-20160816; b=PpIMjkrnKI8NC9Vgv5p+xnIj0MoPVadBqgnCLiZTBbM416+jhm1hH3ndpKEYzXkW1v sOVt7/GoUaAOKVicOcujhdwTSIO1fvS4m/97LYrCzSSbB0LWP8+dRsUegWqyN+vRZllY UrZa59xr4N3CAocRu7p72oVwH3/7TA5UUuFFn4ziAQRHFykZZwvbcdhrWAJxI3iaKlIQ MDiTg9dWlbHol/0Q40oNVXKn3ZvgrVVWc19YoWJ1htxFQ2DOdIqrpstlThxQ5/k3fhEC szeReQ25EL8xkzmD2hamuUhIL8mwJ3x+FXbIRopGDfg5KF9WlNoPSbHc/OYhQsUuevbX Gsaw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:references:in-reply-to:message-id :date:to:from:dkim-signature:delivered-to; bh=3svgn16RG1ZFEG5MkzN2W+5G5yYia6Eh4o/fN6gFPc8=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=g+x0mD216udwwVAlqUHzlwvwtS9rVheGtIkXXq0tqpIBdEF4ZUnEbm3GE6eXW3rB4k 5bzTMSjwoL2//g7htEFEt2QXTlwKX5f1/6gvQ51WleuL01+wsEzck5Wv79m3Q3RnIh4G RNxbeFfCoHzjU36f5uzzDqgjc9ZHoG94dNegzHQVEi66rOtUqzOMQseDgBQE3Knfn8EB yll5D/MQHXoc9ZHtZ+LRhB/b1J2VOBThzL4SF7xmn73I7qfSz07gv0uBDStIsrbtLDql ZS4UmZny9eOJ37fs8EFY6KfBx8m+moNwtkX7+aiAlCM8ipejyPJgiQ7qZQx4F1g531OM Z8Nw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=V50X7DUy; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id j24-20020a170906475800b00a5258d9ae0asi11195936ejs.883.2024.04.26.16.53.05; Fri, 26 Apr 2024 16:53:05 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=V50X7DUy; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id D233E68D418; Sat, 27 Apr 2024 02:52:26 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [217.70.183.197]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 7815768D32B for ; Sat, 27 Apr 2024 02:52:16 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id D58581C0002 for ; Fri, 26 Apr 2024 23:52:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1714175536; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BZBOoVdU1XEBAu3slWGgA4uMPZVUhsmPecx5J49y7mc=; b=V50X7DUyWxoabsvbTftsIAr1UWaVVDBhW2BK+cG/SkEar4KHkWNVx3KyKFE+RX/fQ/wyBr CcjtSbbrTyd0GFytVDcht1kviAV5pcf4V5uEdIl948zflVg50nzZcs7j7g7n0F8lri82EM pcSZOt/0m3kP1VTIVzQKfKq8v8dsz2t0F83O6NbDoVqkXVXx9eF3Zm5mlDoOL1niHFUmby PuVj0ScCcnrlOca5xGPQGJLuIoBfTXEwQFx0A2Wz0/9+pcNGkRxyrjL/IO+argyYyndVJj Z5wzT2j1jAWbEyNbu0Mr7ji72+4MzRfeITPsUeokdq6XnnEYWtHarb71Yr1lXA== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 27 Apr 2024 01:52:11 +0200 Message-ID: <20240426235211.3718252-5-michael@niedermayer.cc> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240426235211.3718252-1-michael@niedermayer.cc> References: <20240426235211.3718252-1-michael@niedermayer.cc> MIME-Version: 1.0 X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 5/5] avformat/mov: Check if heif item name is already allocated X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: S9sW4OYIyMh/ Fixes: memleak Fixes: 68212/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4963488540721152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 97a24e6737e..5b8278f736e 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8136,6 +8136,9 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) avio_rb24(pb); // flags. size -= 4; + if (c->heif_item[idx].name) + return AVERROR_INVALIDDATA; + if (version < 2) { avpriv_report_missing_feature(c->fc, "infe version < 2"); return 1;