From patchwork Sat Oct 24 22:23:05 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 23199 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 6D36F44B718 for ; Sun, 25 Oct 2020 01:24:21 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 4B19768A2B6; Sun, 25 Oct 2020 01:24:21 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe02-1.mx.upcmail.net (vie01a-dmta-pe02-1.mx.upcmail.net [62.179.121.157]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id DA17B680ADB for ; Sun, 25 Oct 2020 01:24:13 +0300 (EEST) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe02.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kWRxN-0002QE-0C for ffmpeg-devel@ffmpeg.org; Sun, 25 Oct 2020 00:24:13 +0200 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id WRwOkOpWjIr7GWRwOkFbdw; Sun, 25 Oct 2020 00:23:13 +0200 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=QN4WuTDL c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=6P2I_FN0h2VCsUEniRwA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=jd6J4Gguk5HxikPWLKER:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 25 Oct 2020 00:23:05 +0200 Message-Id: <20201024222312.5806-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 X-CMAE-Envelope: MS4wfBtuxT0MsPsDxdXuI6000NYdCaC4ekpgJn+PRbNinTOLDYDfa/dVgEigUDBB5QTkAHJS+jLb0PMam9pPFzucGWJB44gF8Lhd9CvD0WQuh/kn/+sozvfw kYrVcTuj3IGqBSwpj8zNKaqvj26DweWZtwKyTcRok7VJdCkvyEAPrcLS Subject: [FFmpeg-devel] [PATCH 1/8] tools/target_dem_fuzzer: Limit max blocks X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" With a IO block size of 1 byte potentially megabytes are quite slow to read, thus limit the number Fixes: 26511/clusterfuzz-testcase-minimized-ffmpeg_dem_NUV_fuzzer-5679249073373184 Fixes: 26517/clusterfuzz-testcase-minimized-ffmpeg_dem_XMV_fuzzer-6316634501021696 Fixes: 26518/clusterfuzz-testcase-minimized-ffmpeg_dem_WSVQA_fuzzer-485568285324083 Fixes: 26525/clusterfuzz-testcase-minimized-ffmpeg_dem_MSNWC_TCP_fuzzer-5121987011411968 Fixes: 26538/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-5441800598454272 Fixes: OOM Fixes: Timeout Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- tools/target_dem_fuzzer.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tools/target_dem_fuzzer.c b/tools/target_dem_fuzzer.c index 8c9e373367..6f4f062f13 100644 --- a/tools/target_dem_fuzzer.c +++ b/tools/target_dem_fuzzer.c @@ -86,6 +86,7 @@ static int64_t io_seek(void *opaque, int64_t offset, int whence) // Ensure we don't loop forever const uint32_t maxiteration = 8096; +const int maxblocks= 100000; static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL; @@ -158,6 +159,10 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { av_strlcatf(filename, sizeof(filename), ".%s", extension); } } + + if (!io_buffer_size || size / io_buffer_size > maxblocks) + io_buffer_size = size; + io_buffer = av_malloc(io_buffer_size); if (!io_buffer) error("Failed to allocate io_buffer"); From patchwork Sat Oct 24 22:23:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 23201 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 1A30344B718 for ; Sun, 25 Oct 2020 01:24:24 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id F004D68A435; Sun, 25 Oct 2020 01:24:23 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-1.mx.upcmail.net (vie01a-dmta-pe05-1.mx.upcmail.net [84.116.36.11]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E8EB6689ABF for ; Sun, 25 Oct 2020 01:24:13 +0300 (EEST) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe05.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kWRxN-0003q5-0F for ffmpeg-devel@ffmpeg.org; Sun, 25 Oct 2020 00:24:13 +0200 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id WRwPkOpYBIr7GWRwPkFbf5; Sun, 25 Oct 2020 00:23:13 +0200 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=QN4WuTDL c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=NKg2boVT5mA7P-A8VZEA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 25 Oct 2020 00:23:06 +0200 Message-Id: <20201024222312.5806-2-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201024222312.5806-1-michael@niedermayer.cc> References: <20201024222312.5806-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfBtuxT0MsPsDxdXuI6000NYdCaC4ekpgJn+PRbNinTOLDYDfa/dVgEigUDBB5QTkAHJS+jLb0PMam9pPFzucGWJB44gF8Lhd9CvD0WQuh/kn/+sozvfw kYrVcTuj3IGqBSwpj8zNKaqvj26DweWZtwKyTcRok7VJdCkvyEAPrcLS Subject: [FFmpeg-devel] [PATCH 2/8] avformat/electronicarts: Check for EOF in each iteration of the loop in ea_read_packet() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: timeout(>20sec -> 1ms) Fixes: 26526/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-5672328069120000 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/electronicarts.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c index d0f483aaf9..4c292f29a2 100644 --- a/libavformat/electronicarts.c +++ b/libavformat/electronicarts.c @@ -582,6 +582,8 @@ static int ea_read_packet(AVFormatContext *s, AVPacket *pkt) int av_uninit(num_samples); while ((!packet_read && !hit_end) || partial_packet) { + if (avio_feof(pb)) + return AVERROR_EOF; chunk_type = avio_rl32(pb); chunk_size = ea->big_endian ? avio_rb32(pb) : avio_rl32(pb); if (chunk_size < 8) From patchwork Sat Oct 24 22:23:07 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 23200 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id B5BD044B718 for ; Sun, 25 Oct 2020 01:24:22 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 9E80F68A7F4; Sun, 25 Oct 2020 01:24:22 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe03-1.mx.upcmail.net (vie01a-dmta-pe03-1.mx.upcmail.net [62.179.121.160]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id DC7206899C9 for ; Sun, 25 Oct 2020 01:24:13 +0300 (EEST) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe03.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kWRxN-0005mf-0E for ffmpeg-devel@ffmpeg.org; Sun, 25 Oct 2020 00:24:13 +0200 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id WRwPkOpYOIr7GWRwPkFbfC; Sun, 25 Oct 2020 00:23:13 +0200 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=QN4WuTDL c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=3kQqQbzWZoL190ifPBoA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 25 Oct 2020 00:23:07 +0200 Message-Id: <20201024222312.5806-3-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201024222312.5806-1-michael@niedermayer.cc> References: <20201024222312.5806-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfBtuxT0MsPsDxdXuI6000NYdCaC4ekpgJn+PRbNinTOLDYDfa/dVgEigUDBB5QTkAHJS+jLb0PMam9pPFzucGWJB44gF8Lhd9CvD0WQuh/kn/+sozvfw kYrVcTuj3IGqBSwpj8zNKaqvj26DweWZtwKyTcRok7VJdCkvyEAPrcLS Subject: [FFmpeg-devel] [PATCH 3/8] avformat/moflex: Check pkt_size X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: Timeout (>20sec -> 1ms) Fixes: 26527/clusterfuzz-testcase-minimized-ffmpeg_dem_MOFLEX_fuzzer-6308307310215168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/moflex.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/moflex.c b/libavformat/moflex.c index a24e12eb8e..8142925adc 100644 --- a/libavformat/moflex.c +++ b/libavformat/moflex.c @@ -316,6 +316,8 @@ static int moflex_read_packet(AVFormatContext *s, AVPacket *pkt) } pkt_size = pop_int(br, pb, 13) + 1; + if (pkt_size > m->size) + return AVERROR_INVALIDDATA; packet = s->streams[stream_index]->priv_data; if (!packet) { avio_skip(pb, pkt_size); From patchwork Sat Oct 24 22:23:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 23204 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 1DF9D44B718 for ; Sun, 25 Oct 2020 01:24:27 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0621C68A9BB; Sun, 25 Oct 2020 01:24:27 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-1.mx.upcmail.net (vie01a-dmta-pe05-1.mx.upcmail.net [84.116.36.11]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 668B2689E13 for ; Sun, 25 Oct 2020 01:24:14 +0300 (EEST) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe05.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kWRxO-0003q5-0f for ffmpeg-devel@ffmpeg.org; Sun, 25 Oct 2020 00:24:14 +0200 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id WRwPkOpYYIr7GWRwQkFbfL; Sun, 25 Oct 2020 00:23:14 +0200 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=QN4WuTDL c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=JROL2-uTM0LZop6tt7YA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 25 Oct 2020 00:23:08 +0200 Message-Id: <20201024222312.5806-4-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201024222312.5806-1-michael@niedermayer.cc> References: <20201024222312.5806-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfHy1MqRPW9tGfD058HhAlynRgmu+SPMPTH2DVpQzxYgh46ugTJShzWDPzLIzPNX6Yc5Dh4t3ggEWKxIw0aphi4HW5Flc6uY23qd/YYYVjWNJPFLPTFOq iFBnBCoSbbtsrPS32ZU0Uh88HB3EQUhE9stQ12Rl0KFT5JFDqF6RHt7N Subject: [FFmpeg-devel] [PATCH 4/8] avformat/paf: Check for EOF in read_table() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: OOM Fixes: 26528/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5081929248145408 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/paf.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/libavformat/paf.c b/libavformat/paf.c index a31d01502b..9587111643 100644 --- a/libavformat/paf.c +++ b/libavformat/paf.c @@ -75,14 +75,18 @@ static int read_close(AVFormatContext *s) return 0; } -static void read_table(AVFormatContext *s, uint32_t *table, uint32_t count) +static int read_table(AVFormatContext *s, uint32_t *table, uint32_t count) { int i; - for (i = 0; i < count; i++) + for (i = 0; i < count; i++) { + if (avio_feof(s->pb)) + return AVERROR_INVALIDDATA; table[i] = avio_rl32(s->pb); + } avio_skip(s->pb, 4 * (FFALIGN(count, 512) - count)); + return 0; } static int read_header(AVFormatContext *s) @@ -171,9 +175,15 @@ static int read_header(AVFormatContext *s) avio_seek(pb, p->buffer_size, SEEK_SET); - read_table(s, p->blocks_count_table, p->nb_frames); - read_table(s, p->frames_offset_table, p->nb_frames); - read_table(s, p->blocks_offset_table, p->frame_blks); + ret = read_table(s, p->blocks_count_table, p->nb_frames); + if (ret < 0) + goto fail; + ret = read_table(s, p->frames_offset_table, p->nb_frames); + if (ret < 0) + goto fail; + ret = read_table(s, p->blocks_offset_table, p->frame_blks); + if (ret < 0) + goto fail; p->got_audio = 0; p->current_frame = 0; From patchwork Sat Oct 24 22:23:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 23203 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 2C0C044B718 for ; Sun, 25 Oct 2020 01:24:26 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 13EB168A9D5; Sun, 25 Oct 2020 01:24:26 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-1.mx.upcmail.net (vie01a-dmta-pe05-1.mx.upcmail.net [84.116.36.11]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 5BB54689CFA for ; Sun, 25 Oct 2020 01:24:14 +0300 (EEST) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe05.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kWRxO-0004RU-0f for ffmpeg-devel@ffmpeg.org; Sun, 25 Oct 2020 00:24:14 +0200 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id WRwQkOpYkIr7GWRwQkFbfr; Sun, 25 Oct 2020 00:23:14 +0200 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=QN4WuTDL c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=y2Gkb-ytfN5d1m4xtPYA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 25 Oct 2020 00:23:09 +0200 Message-Id: <20201024222312.5806-5-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201024222312.5806-1-michael@niedermayer.cc> References: <20201024222312.5806-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfHy1MqRPW9tGfD058HhAlynRgmu+SPMPTH2DVpQzxYgh46ugTJShzWDPzLIzPNX6Yc5Dh4t3ggEWKxIw0aphi4HW5Flc6uY23qd/YYYVjWNJPFLPTFOq iFBnBCoSbbtsrPS32ZU0Uh88HB3EQUhE9stQ12Rl0KFT5JFDqF6RHt7N Subject: [FFmpeg-devel] [PATCH 5/8] tools/target_dem_fuzzer: Consider it an EIO when reading position wraps around 64bit X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: signed integer overflow: 9223372036854775807 + 564 cannot be represented in type 'long' Fixes: 26494/clusterfuzz-testcase-minimized-ffmpeg_dem_VOC_fuzzer-576754158849228 Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- tools/target_dem_fuzzer.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/target_dem_fuzzer.c b/tools/target_dem_fuzzer.c index 6f4f062f13..e4f41765d6 100644 --- a/tools/target_dem_fuzzer.c +++ b/tools/target_dem_fuzzer.c @@ -49,6 +49,8 @@ static int io_read(void *opaque, uint8_t *buf, int buf_size) c->filesize = FFMIN(c->pos, c->filesize); return AVERROR_EOF; } + if (c->pos > INT64_MAX - size) + return AVERROR(EIO); memcpy(buf, c->fuzz, size); c->fuzz += size; From patchwork Sat Oct 24 22:23:10 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 23205 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 25DE844B718 for ; Sun, 25 Oct 2020 01:24:28 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0860E68A0C3; Sun, 25 Oct 2020 01:24:28 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-1.mx.upcmail.net (vie01a-dmta-pe05-1.mx.upcmail.net [84.116.36.11]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 623FC689D26 for ; Sun, 25 Oct 2020 01:24:14 +0300 (EEST) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe05.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kWRxO-0004RS-0f for ffmpeg-devel@ffmpeg.org; Sun, 25 Oct 2020 00:24:14 +0200 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id WRwQkOpZEIr7GWRwQkFbg6; Sun, 25 Oct 2020 00:23:14 +0200 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=QN4WuTDL c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=pWmhevCsQ4smKdkom3MA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 25 Oct 2020 00:23:10 +0200 Message-Id: <20201024222312.5806-6-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201024222312.5806-1-michael@niedermayer.cc> References: <20201024222312.5806-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfHy1MqRPW9tGfD058HhAlynRgmu+SPMPTH2DVpQzxYgh46ugTJShzWDPzLIzPNX6Yc5Dh4t3ggEWKxIw0aphi4HW5Flc6uY23qd/YYYVjWNJPFLPTFOq iFBnBCoSbbtsrPS32ZU0Uh88HB3EQUhE9stQ12Rl0KFT5JFDqF6RHt7N Subject: [FFmpeg-devel] [PATCH 6/8] avformat/avs: Use 64bit for the avio_tell() output X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long' Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/avs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/avs.c b/libavformat/avs.c index 54b2c3f2a9..097c171908 100644 --- a/libavformat/avs.c +++ b/libavformat/avs.c @@ -128,7 +128,8 @@ avs_read_video_packet(AVFormatContext * s, AVPacket * pkt, static int avs_read_audio_packet(AVFormatContext * s, AVPacket * pkt) { AvsFormat *avs = s->priv_data; - int ret, size; + int ret; + int64_t size; size = avio_tell(s->pb); ret = ff_voc_get_packet(s, pkt, avs->st_audio, avs->remaining_audio_size); From patchwork Sat Oct 24 22:23:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 23202 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 2584044B718 for ; Sun, 25 Oct 2020 01:24:25 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0BB7368A98A; Sun, 25 Oct 2020 01:24:25 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe02-1.mx.upcmail.net (vie01a-dmta-pe02-1.mx.upcmail.net [62.179.121.157]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 55EA5689ABF for ; Sun, 25 Oct 2020 01:24:14 +0300 (EEST) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe02.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kWRxO-0002QG-0d for ffmpeg-devel@ffmpeg.org; Sun, 25 Oct 2020 00:24:14 +0200 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id WRwQkOpZpIr7GWRwQkFbgI; Sun, 25 Oct 2020 00:23:14 +0200 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=QN4WuTDL c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=H-zZyt7FPopQiup03qkA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 25 Oct 2020 00:23:11 +0200 Message-Id: <20201024222312.5806-7-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201024222312.5806-1-michael@niedermayer.cc> References: <20201024222312.5806-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfHy1MqRPW9tGfD058HhAlynRgmu+SPMPTH2DVpQzxYgh46ugTJShzWDPzLIzPNX6Yc5Dh4t3ggEWKxIw0aphi4HW5Flc6uY23qd/YYYVjWNJPFLPTFOq iFBnBCoSbbtsrPS32ZU0Uh88HB3EQUhE9stQ12Rl0KFT5JFDqF6RHt7N Subject: [FFmpeg-devel] [PATCH 7/8] avcodec/exr: Check ymin vs. h X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: out of array access Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/exr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index cf7824402a..25c4f82471 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -1830,7 +1830,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, // Zero out the start if ymin is not 0 for (i = 0; i < planes; i++) { ptr = picture->data[i]; - for (y = 0; y < s->ymin; y++) { + for (y = 0; y < FFMIN(s->ymin, s->h); y++) { memset(ptr, 0, out_line_size); ptr += picture->linesize[i]; } From patchwork Sat Oct 24 22:23:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 23206 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 174F144B718 for ; Sun, 25 Oct 2020 01:24:29 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id ECFBB68A0EA; Sun, 25 Oct 2020 01:24:28 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe06-1.mx.upcmail.net (vie01a-dmta-pe06-1.mx.upcmail.net [84.116.36.14]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 9E03C689D26 for ; Sun, 25 Oct 2020 01:24:14 +0300 (EEST) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe06.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kWRxO-0008AI-0d for ffmpeg-devel@ffmpeg.org; Sun, 25 Oct 2020 00:24:14 +0200 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id WRwQkOpaDIr7GWRwQkFbgT; Sun, 25 Oct 2020 00:23:14 +0200 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=QN4WuTDL c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=xtTkBwfydTuNxjV0vp0A:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 25 Oct 2020 00:23:12 +0200 Message-Id: <20201024222312.5806-8-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201024222312.5806-1-michael@niedermayer.cc> References: <20201024222312.5806-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfHy1MqRPW9tGfD058HhAlynRgmu+SPMPTH2DVpQzxYgh46ugTJShzWDPzLIzPNX6Yc5Dh4t3ggEWKxIw0aphi4HW5Flc6uY23qd/YYYVjWNJPFLPTFOq iFBnBCoSbbtsrPS32ZU0Uh88HB3EQUhE9stQ12Rl0KFT5JFDqF6RHt7N Subject: [FFmpeg-devel] [PATCH 8/8] avcodec/exr: skip bottom clearing loop when its outside the image X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: signed integer overflow: 1633771809 * 32960 cannot be represented in type 'int' Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/exr.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index 25c4f82471..a6435d33a4 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -1842,13 +1842,14 @@ static int decode_frame(AVCodecContext *avctx, void *data, ymax = FFMAX(0, s->ymax + 1); // Zero out the end if ymax+1 is not h - for (i = 0; i < planes; i++) { - ptr = picture->data[i] + (ymax * picture->linesize[i]); - for (y = ymax; y < avctx->height; y++) { - memset(ptr, 0, out_line_size); - ptr += picture->linesize[i]; + if (ymax < avctx->height) + for (i = 0; i < planes; i++) { + ptr = picture->data[i] + (ymax * picture->linesize[i]); + for (y = ymax; y < avctx->height; y++) { + memset(ptr, 0, out_line_size); + ptr += picture->linesize[i]; + } } - } picture->pict_type = AV_PICTURE_TYPE_I; *got_frame = 1;