From patchwork Fri Dec 18 23:22:01 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 24586 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id B134D44B398 for ; Sat, 19 Dec 2020 02:36:46 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 8F6DF68A83C; Sat, 19 Dec 2020 02:36:46 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe02-1.mx.upcmail.net (vie01a-dmta-pe02-1.mx.upcmail.net [62.179.121.157]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 81B1C68A551 for ; Sat, 19 Dec 2020 02:36:39 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe02.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kqP5Z-0003i9-0X for ffmpeg-devel@ffmpeg.org; Sat, 19 Dec 2020 00:23:09 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id qP4aku6ZxO4rAqP4akse3C; Sat, 19 Dec 2020 00:22:08 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=AqA1IkcsIgmisLcCMQoA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=bWyr8ysk75zN3GCy5bjg:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 19 Dec 2020 00:22:01 +0100 Message-Id: <20201218232208.14207-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 X-CMAE-Envelope: MS4wfM2MSGnFWELsbMnYiB7wK9pQEqJInineRJN5+r/rT2VQ4k8QNyAMTrVbn/ORkgL7q6JyoCQsSxDjjXFBW1XRIV1h1KoiHrG1VQ8324NhVclBwNW5lfRl U4HMoNAQ+baEmVaVYgaYE1QY2fKpjgMlaq3MLa+gpnK6PDfReFXPFT8z Subject: [FFmpeg-devel] [PATCH 1/8] avformat/mpegts: Increase pcr_incr width to 64bit X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: division by zero Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176 Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/mpegts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 7549fc91c9..1122455f66 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -135,7 +135,7 @@ struct MpegTSContext { int fix_teletext_pts; int64_t cur_pcr; /**< used to estimate the exact PCR */ - int pcr_incr; /**< used to estimate the exact PCR */ + int64_t pcr_incr; /**< used to estimate the exact PCR */ /* data needed to handle file based ts */ /** stop parsing loop */ From patchwork Fri Dec 18 23:22:02 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 24587 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 3AB0C44BB22 for ; Sat, 19 Dec 2020 02:37:38 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 199AF68AB33; Sat, 19 Dec 2020 02:37:38 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe02-1.mx.upcmail.net (vie01a-dmta-pe02-1.mx.upcmail.net [62.179.121.157]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id F286D6881BB for ; Sat, 19 Dec 2020 02:37:31 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe02.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kqP5Z-0003iA-0X for ffmpeg-devel@ffmpeg.org; Sat, 19 Dec 2020 00:23:09 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id qP4bku6b7O4rAqP4bkse3X; Sat, 19 Dec 2020 00:22:09 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=XAX7ocOAgT97i6Tl-DoA:9 a=pHzHmUro8NiASowvMSCR:22 a=Ew2E2A-JSTLzCXPT_086:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 19 Dec 2020 00:22:02 +0100 Message-Id: <20201218232208.14207-2-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201218232208.14207-1-michael@niedermayer.cc> References: <20201218232208.14207-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfM2MSGnFWELsbMnYiB7wK9pQEqJInineRJN5+r/rT2VQ4k8QNyAMTrVbn/ORkgL7q6JyoCQsSxDjjXFBW1XRIV1h1KoiHrG1VQ8324NhVclBwNW5lfRl U4HMoNAQ+baEmVaVYgaYE1QY2fKpjgMlaq3MLa+gpnK6PDfReFXPFT8z Subject: [FFmpeg-devel] [PATCH 2/8] avformat/mpegts: simplify nb_packets code X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Signed-off-by: Michael Niedermayer --- libavformat/mpegts.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 1122455f66..cc292ab929 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -3090,7 +3090,6 @@ static int mpegts_read_header(AVFormatContext *s) AVStream *st; int pcr_pid, pid, nb_packets, nb_pcrs, ret, pcr_l; int64_t pcrs[2], pcr_h; - int packet_count[2]; uint8_t packet[TS_PACKET_SIZE]; const uint8_t *data; @@ -3116,7 +3115,6 @@ static int mpegts_read_header(AVFormatContext *s) parse_pcr(&pcr_h, &pcr_l, data) == 0) { finished_reading_packet(s, ts->raw_packet_size); pcr_pid = pid; - packet_count[nb_pcrs] = nb_packets; pcrs[nb_pcrs] = pcr_h * 300 + pcr_l; nb_pcrs++; if (nb_pcrs >= 2) { @@ -3126,7 +3124,6 @@ static int mpegts_read_header(AVFormatContext *s) } else { av_log(ts->stream, AV_LOG_WARNING, "invalid pcr pair %"PRId64" >= %"PRId64"\n", pcrs[0], pcrs[1]); pcrs[0] = pcrs[1]; - packet_count[0] = packet_count[1]; nb_pcrs--; } } @@ -3138,8 +3135,8 @@ static int mpegts_read_header(AVFormatContext *s) /* NOTE1: the bitrate is computed without the FEC */ /* NOTE2: it is only the bitrate of the start of the stream */ - ts->pcr_incr = (pcrs[1] - pcrs[0]) / (packet_count[1] - packet_count[0]); - ts->cur_pcr = pcrs[0] - ts->pcr_incr * packet_count[0]; + ts->pcr_incr = pcrs[1] - pcrs[0]; + ts->cur_pcr = pcrs[0] - ts->pcr_incr * (nb_packets - 1); s->bit_rate = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr; st->codecpar->bit_rate = s->bit_rate; st->start_time = ts->cur_pcr; From patchwork Fri Dec 18 23:22:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 24585 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 4C285449D49 for ; Sat, 19 Dec 2020 01:49:09 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 2AB0168AA47; Sat, 19 Dec 2020 01:49:09 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe06-2.mx.upcmail.net (vie01a-dmta-pe06-2.mx.upcmail.net [84.116.36.15]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E4D8B68A862 for ; Sat, 19 Dec 2020 01:49:02 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe06.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kqP5Z-0009t9-0M for ffmpeg-devel@ffmpeg.org; Sat, 19 Dec 2020 00:23:09 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id qP4bku6bMO4rAqP4bkse3d; Sat, 19 Dec 2020 00:22:09 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=4k0IzpgUjQ3Gy0w3CbMA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 19 Dec 2020 00:22:03 +0100 Message-Id: <20201218232208.14207-3-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201218232208.14207-1-michael@niedermayer.cc> References: <20201218232208.14207-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfM2MSGnFWELsbMnYiB7wK9pQEqJInineRJN5+r/rT2VQ4k8QNyAMTrVbn/ORkgL7q6JyoCQsSxDjjXFBW1XRIV1h1KoiHrG1VQ8324NhVclBwNW5lfRl U4HMoNAQ+baEmVaVYgaYE1QY2fKpjgMlaq3MLa+gpnK6PDfReFXPFT8z Subject: [FFmpeg-devel] [PATCH 3/8] avcodec/simple_idct: Fix undefined integer overflow in idct4row() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: signed integer overflow: -1498310196 - 902891776 cannot be represented in type 'int' Fixes: 28445/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5075163389493248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/simple_idct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/simple_idct.c b/libavcodec/simple_idct.c index 3b2e736538..0ef167491a 100644 --- a/libavcodec/simple_idct.c +++ b/libavcodec/simple_idct.c @@ -175,7 +175,8 @@ static inline void idct4col_add(uint8_t *dest, ptrdiff_t line_size, const int16_ #define R_SHIFT 11 static inline void idct4row(int16_t *row) { - int c0, c1, c2, c3, a0, a1, a2, a3; + unsigned c0, c1, c2, c3; + int a0, a1, a2, a3; a0 = row[0]; a1 = row[1]; From patchwork Fri Dec 18 23:22:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 24588 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 7EE1644B447 for ; Sat, 19 Dec 2020 02:42:04 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 5EECE68A8E2; Sat, 19 Dec 2020 02:42:04 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe02-1.mx.upcmail.net (vie01a-dmta-pe02-1.mx.upcmail.net [62.179.121.157]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id ED42D68A8E2 for ; Sat, 19 Dec 2020 02:41:57 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe02.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kqP5Z-0003dI-0M for ffmpeg-devel@ffmpeg.org; Sat, 19 Dec 2020 00:23:09 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id qP4bku6baO4rAqP4bkse3g; Sat, 19 Dec 2020 00:22:09 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=xJqtoM6AmN4Bodbqw_8A:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 19 Dec 2020 00:22:04 +0100 Message-Id: <20201218232208.14207-4-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201218232208.14207-1-michael@niedermayer.cc> References: <20201218232208.14207-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfM2MSGnFWELsbMnYiB7wK9pQEqJInineRJN5+r/rT2VQ4k8QNyAMTrVbn/ORkgL7q6JyoCQsSxDjjXFBW1XRIV1h1KoiHrG1VQ8324NhVclBwNW5lfRl U4HMoNAQ+baEmVaVYgaYE1QY2fKpjgMlaq3MLa+gpnK6PDfReFXPFT8z Subject: [FFmpeg-devel] [PATCH 4/8] avcodec/ffv1dec: Fix off by 1 error with quant tables X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: assertion failure Fixes: 28447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5369575948550144 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/ffv1dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index c704373cfe..0a3f425493 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -786,7 +786,7 @@ static int read_header(FFV1Context *f) if (f->version == 2) { int idx = get_symbol(c, state, 0); - if (idx > (unsigned)f->quant_table_count) { + if (idx >= (unsigned)f->quant_table_count) { av_log(f->avctx, AV_LOG_ERROR, "quant_table_index out of range\n"); return AVERROR_INVALIDDATA; From patchwork Fri Dec 18 23:22:05 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 24584 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id B550444B6E8 for ; Sat, 19 Dec 2020 01:36:09 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 9DACC68AA24; Sat, 19 Dec 2020 01:36:09 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-2.mx.upcmail.net (vie01a-dmta-pe05-2.mx.upcmail.net [84.116.36.12]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 096A968A03B for ; Sat, 19 Dec 2020 01:36:02 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe05.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kqP5Z-0006dW-0M for ffmpeg-devel@ffmpeg.org; Sat, 19 Dec 2020 00:23:09 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id qP4bku6btO4rAqP4bkse3l; Sat, 19 Dec 2020 00:22:09 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=bX-4owC32k2lxmSPrIsA:9 a=pHzHmUro8NiASowvMSCR:22 a=Ew2E2A-JSTLzCXPT_086:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 19 Dec 2020 00:22:05 +0100 Message-Id: <20201218232208.14207-5-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201218232208.14207-1-michael@niedermayer.cc> References: <20201218232208.14207-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfM2MSGnFWELsbMnYiB7wK9pQEqJInineRJN5+r/rT2VQ4k8QNyAMTrVbn/ORkgL7q6JyoCQsSxDjjXFBW1XRIV1h1KoiHrG1VQ8324NhVclBwNW5lfRl U4HMoNAQ+baEmVaVYgaYE1QY2fKpjgMlaq3MLa+gpnK6PDfReFXPFT8z Subject: [FFmpeg-devel] [PATCH 5/8] avcodec/hevc_ps: check scaling_list_dc_coef X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int' Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480 Signed-off-by: Michael Niedermayer --- libavcodec/hevc_ps.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index ea6fd536c6..139f3deeda 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -816,7 +816,11 @@ static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingLi next_coef = 8; coef_num = FFMIN(64, 1 << (4 + (size_id << 1))); if (size_id > 1) { - scaling_list_dc_coef[size_id - 2][matrix_id] = get_se_golomb(gb) + 8; + int scaling_list_coeff_minus8 = get_se_golomb(gb); + if (scaling_list_coeff_minus8 < -7 || + scaling_list_coeff_minus8 > 247) + return AVERROR_INVALIDDATA; + scaling_list_dc_coef[size_id - 2][matrix_id] = scaling_list_coeff_minus8 + 8; next_coef = scaling_list_dc_coef[size_id - 2][matrix_id]; sl->sl_dc[size_id - 2][matrix_id] = next_coef; } From patchwork Fri Dec 18 23:22:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 24589 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id BDCB244A242 for ; Sat, 19 Dec 2020 02:43:18 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 99E6C68AB48; Sat, 19 Dec 2020 02:43:18 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe02-1.mx.upcmail.net (vie01a-dmta-pe02-1.mx.upcmail.net [62.179.121.157]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 9B8CB68AA07 for ; Sat, 19 Dec 2020 02:43:11 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe02.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kqP5Z-0003eA-0M for ffmpeg-devel@ffmpeg.org; Sat, 19 Dec 2020 00:23:09 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id qP4bku6cCO4rAqP4bkse3q; Sat, 19 Dec 2020 00:22:09 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=ZNNBUUHI3upC_tJZ3h4A:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 19 Dec 2020 00:22:06 +0100 Message-Id: <20201218232208.14207-6-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201218232208.14207-1-michael@niedermayer.cc> References: <20201218232208.14207-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfM2MSGnFWELsbMnYiB7wK9pQEqJInineRJN5+r/rT2VQ4k8QNyAMTrVbn/ORkgL7q6JyoCQsSxDjjXFBW1XRIV1h1KoiHrG1VQ8324NhVclBwNW5lfRl U4HMoNAQ+baEmVaVYgaYE1QY2fKpjgMlaq3MLa+gpnK6PDfReFXPFT8z Subject: [FFmpeg-devel] [PATCH 6/8] avformat/rmdec: Fix codecdata_length overflow check X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int' Fixes: 28509/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6310969680723968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/rmdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 004c62086d..ae83a8afe7 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -254,7 +254,7 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, if (version == 5) avio_r8(pb); codecdata_length = avio_rb32(pb); - if(codecdata_length + AV_INPUT_BUFFER_PADDING_SIZE <= (unsigned)codecdata_length){ + if((unsigned)codecdata_length > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE){ av_log(s, AV_LOG_ERROR, "codecdata_length too large\n"); return -1; } From patchwork Fri Dec 18 23:22:07 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 24582 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 3AD32449FC7 for ; Sat, 19 Dec 2020 01:35:20 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 1336E68A903; Sat, 19 Dec 2020 01:35:20 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe03-1.mx.upcmail.net (vie01a-dmta-pe03-1.mx.upcmail.net [62.179.121.160]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 3442568A32E for ; Sat, 19 Dec 2020 01:35:13 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe03.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kqP5Z-0000pu-0M for ffmpeg-devel@ffmpeg.org; Sat, 19 Dec 2020 00:23:09 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id qP4bku6cbO4rAqP4bkse3v; Sat, 19 Dec 2020 00:22:09 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=rWaRxOLpgLh6nDTbhf8A:9 a=pHzHmUro8NiASowvMSCR:22 a=Ew2E2A-JSTLzCXPT_086:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 19 Dec 2020 00:22:07 +0100 Message-Id: <20201218232208.14207-7-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201218232208.14207-1-michael@niedermayer.cc> References: <20201218232208.14207-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfM2MSGnFWELsbMnYiB7wK9pQEqJInineRJN5+r/rT2VQ4k8QNyAMTrVbn/ORkgL7q6JyoCQsSxDjjXFBW1XRIV1h1KoiHrG1VQ8324NhVclBwNW5lfRl U4HMoNAQ+baEmVaVYgaYE1QY2fKpjgMlaq3MLa+gpnK6PDfReFXPFT8z Subject: [FFmpeg-devel] [PATCH 7/8] avformat/aviobuf: Check for overflow in ffio_read_varlen() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" No testcase Signed-off-by: Michael Niedermayer --- libavformat/aviobuf.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 78cc60b2ae..7730547106 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -917,6 +917,8 @@ uint64_t ffio_read_varlen(AVIOContext *bc){ do{ tmp = avio_r8(bc); + if (val > UINT64_MAX>>7) + return AVERROR_INVALIDDATA; val= (val<<7) + (tmp&127); }while(tmp&128); return val; From patchwork Fri Dec 18 23:22:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 24583 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id A4E59449FC7 for ; Sat, 19 Dec 2020 01:35:28 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 877C368AB0E; Sat, 19 Dec 2020 01:35:28 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-2.mx.upcmail.net (vie01a-dmta-pe05-2.mx.upcmail.net [84.116.36.12]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 800C0687FCE for ; Sat, 19 Dec 2020 01:35:22 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe05.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1kqP5a-0006dW-0C for ffmpeg-devel@ffmpeg.org; Sat, 19 Dec 2020 00:23:10 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id qP4bku6cyO4rAqP4bkse3z; Sat, 19 Dec 2020 00:22:10 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=XF_qkW0fILX3y2eUc4YA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 19 Dec 2020 00:22:08 +0100 Message-Id: <20201218232208.14207-8-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201218232208.14207-1-michael@niedermayer.cc> References: <20201218232208.14207-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfCTqNh1gkGTbNEMUG0su8M5RoLRTxG8kTSH0jH4GLdVNwlzDinDoUy51M/vb2gzwwCFEgJv+uBKxIqpA5Qi2zcfb8T1TNjsKVKdtCTSOz3qNBh3RWr3K 7C8MZ6/b9F/wXMMCU0sicIzuIxjn5fFp/Z10YULwIfu9XhBgblCvt9un Subject: [FFmpeg-devel] [PATCH 8/8] avformat/nutdec: Check timebase count against main header length X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: Timeout (long -> 3ms) Fixes: 28514/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6078669009321984 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/nutdec.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c index 53a052503e..7e03d52ac8 100644 --- a/libavformat/nutdec.c +++ b/libavformat/nutdec.c @@ -193,13 +193,13 @@ static int decode_main_header(NUTContext *nut) { AVFormatContext *s = nut->avf; AVIOContext *bc = s->pb; - uint64_t tmp, end; + uint64_t tmp, end, length; unsigned int stream_count; int i, j, count, ret; int tmp_stream, tmp_mul, tmp_pts, tmp_size, tmp_res, tmp_head_idx; - end = get_packetheader(nut, bc, 1, MAIN_STARTCODE); - end += avio_tell(bc); + length = get_packetheader(nut, bc, 1, MAIN_STARTCODE); + end = length + avio_tell(bc); nut->version = ffio_read_varlen(bc); if (nut->version < NUT_MIN_VERSION || @@ -219,7 +219,7 @@ static int decode_main_header(NUTContext *nut) nut->max_distance = 65536; } - GET_V(nut->time_base_count, tmp > 0 && tmp < INT_MAX / sizeof(AVRational)); + GET_V(nut->time_base_count, tmp > 0 && tmp < INT_MAX / sizeof(AVRational) && tmp < length/2); nut->time_base = av_malloc_array(nut->time_base_count, sizeof(AVRational)); if (!nut->time_base) return AVERROR(ENOMEM);