From patchwork Sun Jan 31 19:18:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25295 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 269C2448FBA for ; Sun, 31 Jan 2021 21:20:27 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0ED0D689E91; Sun, 31 Jan 2021 21:20:27 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe06-1.mx.upcmail.net (vie01a-dmta-pe06-1.mx.upcmail.net [84.116.36.14]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 5B3C7689A02 for ; Sun, 31 Jan 2021 21:20:19 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe06.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IGh-00084B-0C for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:20:19 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IEkldmlSO4rA6IEklfTNo; Sun, 31 Jan 2021 20:18:19 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=ZTkZREdAlvyQprRopJgA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:07 +0100 Message-Id: <20210131191818.17203-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 X-CMAE-Envelope: MS4wfFNUfD/FF9XsIQf/+hAtZC6UQhqWQ9UMEEJIEq9U8oJIYtqDAjLP5y8dc7GkbDkREIFpSXTc7bm/fGib3mhTm1jbViDmUFHF1GyZxX4Ye44VDxtFJdti Xsi0jx2uRaJSOWC7iCw41SddAR0OQwMr3ytbaGfyeCAtc3taFdc42ZG+ Subject: [FFmpeg-devel] [PATCH 01/12] avcodec/hevc_sei: Check payload size in decode_nal_sei_message() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: out of array access Fixes: 29392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4821602850177024.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/hevc_sei.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/hevc_sei.c b/libavcodec/hevc_sei.c index 227560c55b..c881c4338c 100644 --- a/libavcodec/hevc_sei.c +++ b/libavcodec/hevc_sei.c @@ -463,6 +463,8 @@ static int decode_nal_sei_message(GetBitContext *gb, void *logctx, HEVCSEI *s, byte = get_bits(gb, 8); payload_size += byte; } + if (get_bits_left(gb) < 8LL*payload_size) + return AVERROR_INVALIDDATA; if (nal_unit_type == HEVC_NAL_SEI_PREFIX) { return decode_nal_sei_prefix(gb, logctx, s, ps, payload_type, payload_size); } else { /* nal_unit_type == NAL_SEI_SUFFIX */ From patchwork Sun Jan 31 19:18:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25299 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 6A5B5448FBA for ; Sun, 31 Jan 2021 21:20:34 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 4D674689CD5; Sun, 31 Jan 2021 21:20:34 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe03-3.mx.upcmail.net (vie01a-dmta-pe03-3.mx.upcmail.net [62.179.121.162]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 4A89B68A148 for ; Sun, 31 Jan 2021 21:20:32 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe03.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IFj-000ADD-0M for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:19:19 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IElldmmNO4rA6IEllfTO3; Sun, 31 Jan 2021 20:18:19 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=UI1l0wjLCh55R4TH5U0A:9 a=pHzHmUro8NiASowvMSCR:22 a=Ew2E2A-JSTLzCXPT_086:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:08 +0100 Message-Id: <20210131191818.17203-2-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfFNUfD/FF9XsIQf/+hAtZC6UQhqWQ9UMEEJIEq9U8oJIYtqDAjLP5y8dc7GkbDkREIFpSXTc7bm/fGib3mhTm1jbViDmUFHF1GyZxX4Ye44VDxtFJdti Xsi0jx2uRaJSOWC7iCw41SddAR0OQwMr3ytbaGfyeCAtc3taFdc42ZG+ Subject: [FFmpeg-devel] [PATCH 02/12] libavutil/common: Add FFABS64U() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Signed-off-by: Michael Niedermayer --- doc/APIchanges | 3 +++ libavutil/common.h | 1 + 2 files changed, 4 insertions(+) diff --git a/doc/APIchanges b/doc/APIchanges index 1332694820..4753463c90 100644 --- a/doc/APIchanges +++ b/doc/APIchanges @@ -15,6 +15,9 @@ libavutil: 2017-10-21 API changes, most recent first: +2021-02-xx - xxxxxxxxxx - lavu 56.xx.100 - common.h + Add FFABS64U() + 2021-01-26 - xxxxxxxxxx - lavu 56.64.100 - common.h Add FFABSU() diff --git a/libavutil/common.h b/libavutil/common.h index a60a558b1d..5ccbed90b1 100644 --- a/libavutil/common.h +++ b/libavutil/common.h @@ -87,6 +87,7 @@ * As with many macros, this evaluates its argument twice. */ #define FFABSU(a) ((a) <= 0 ? -(unsigned)(a) : (unsigned)(a)) +#define FFABS64U(a) ((a) <= 0 ? -(uint64_t)(a) : (uint64_t)(a)) /** * Comparator. From patchwork Sun Jan 31 19:18:09 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25294 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 58126448FBA for ; Sun, 31 Jan 2021 21:20:26 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 3D77A689A8D; Sun, 31 Jan 2021 21:20:26 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe03-3.mx.upcmail.net (vie01a-dmta-pe03-3.mx.upcmail.net [62.179.121.162]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 427AC687F71 for ; Sun, 31 Jan 2021 21:20:19 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe03.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IGh-0009s8-0A for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:20:19 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IElldmmmO4rA6IEllfTOC; Sun, 31 Jan 2021 20:18:19 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=Q23ByBxr_5RLayU7vhgA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:09 +0100 Message-Id: <20210131191818.17203-3-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfFNUfD/FF9XsIQf/+hAtZC6UQhqWQ9UMEEJIEq9U8oJIYtqDAjLP5y8dc7GkbDkREIFpSXTc7bm/fGib3mhTm1jbViDmUFHF1GyZxX4Ye44VDxtFJdti Xsi0jx2uRaJSOWC7iCw41SddAR0OQwMr3ytbaGfyeCAtc3taFdc42ZG+ Subject: [FFmpeg-devel] [PATCH 03/12] avutil/mathematics: Fix undefined negation in av_compare_ts() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself Fixes: 29437/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4748510022991872 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavutil/mathematics.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavutil/mathematics.c b/libavutil/mathematics.c index da0fc17b2e..2de2b39da0 100644 --- a/libavutil/mathematics.c +++ b/libavutil/mathematics.c @@ -148,7 +148,7 @@ int av_compare_ts(int64_t ts_a, AVRational tb_a, int64_t ts_b, AVRational tb_b) { int64_t a = tb_a.num * (int64_t)tb_b.den; int64_t b = tb_b.num * (int64_t)tb_a.den; - if ((FFABS(ts_a)|a|FFABS(ts_b)|b) <= INT_MAX) + if ((FFABS64U(ts_a)|a|FFABS64U(ts_b)|b) <= INT_MAX) return (ts_a*a > ts_b*b) - (ts_a*a < ts_b*b); if (av_rescale_rnd(ts_a, a, b, AV_ROUND_DOWN) < ts_b) return -1; From patchwork Sun Jan 31 19:18:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25289 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 507D644B7AF for ; Sun, 31 Jan 2021 21:19:26 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 1799A689A8B; Sun, 31 Jan 2021 21:19:26 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-2.mx.upcmail.net (vie01a-dmta-pe05-2.mx.upcmail.net [84.116.36.12]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 963956881B2 for ; Sun, 31 Jan 2021 21:19:19 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe05.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IFj-0008Jq-0N for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:19:19 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IElldmnBO4rA6IEllfTOJ; Sun, 31 Jan 2021 20:18:19 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=WehNAToxADu8ogoG2l0A:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:10 +0100 Message-Id: <20210131191818.17203-4-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfFNUfD/FF9XsIQf/+hAtZC6UQhqWQ9UMEEJIEq9U8oJIYtqDAjLP5y8dc7GkbDkREIFpSXTc7bm/fGib3mhTm1jbViDmUFHF1GyZxX4Ye44VDxtFJdti Xsi0jx2uRaJSOWC7iCw41SddAR0OQwMr3ytbaGfyeCAtc3taFdc42ZG+ Subject: [FFmpeg-devel] [PATCH 04/12] avformat/id3v2: Check the return from avio_get_str() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: out of array access Fixes: 29446/clusterfuzz-testcase-minimized-ffmpeg_dem_AAC_fuzzer-5096222622875648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/id3v2.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 97f6cc8a68..df11b5450c 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -605,7 +605,10 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen, /* mimetype */ if (isv34) { - taglen -= avio_get_str(pb, taglen, mimetype, sizeof(mimetype)); + int ret = avio_get_str(pb, taglen, mimetype, sizeof(mimetype)); + if (ret < 0 || ret >= taglen) + goto fail; + taglen -= ret; } else { if (avio_read(pb, mimetype, 3) < 0) goto fail; From patchwork Sun Jan 31 19:18:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25293 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 6A5FA448FBA for ; Sun, 31 Jan 2021 21:20:25 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 4B2EF687F71; Sun, 31 Jan 2021 21:20:25 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe01-2.mx.upcmail.net (vie01a-dmta-pe01-2.mx.upcmail.net [62.179.121.155]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 452906899A5 for ; Sun, 31 Jan 2021 21:20:19 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe01.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IGh-0008XX-0B for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:20:19 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IElldmnbO4rA6IEllfTON; Sun, 31 Jan 2021 20:18:19 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=PNFEPLnFpou7r2xT2uQA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=GiHQeXbIydbNWtWbTz-1:22 a=p-dnK0njbqwfn1k4-x12:22 a=7aar8cbMflRChVwg8ngv:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:11 +0100 Message-Id: <20210131191818.17203-5-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfFNUfD/FF9XsIQf/+hAtZC6UQhqWQ9UMEEJIEq9U8oJIYtqDAjLP5y8dc7GkbDkREIFpSXTc7bm/fGib3mhTm1jbViDmUFHF1GyZxX4Ye44VDxtFJdti Xsi0jx2uRaJSOWC7iCw41SddAR0OQwMr3ytbaGfyeCAtc3taFdc42ZG+ Subject: [FFmpeg-devel] [PATCH 05/12] avcodec/jpeglsdec: Fix k=16 in ls_get_code_regular() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: Timeout Fixes: left shift of 33046 by 16 places cannot be represented in type 'int' Fixes: 29258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-4889231489105920 Fixes: 29515/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-6161940391002112 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/jpeglsdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c index ef97bdb297..69980eaa49 100644 --- a/libavcodec/jpeglsdec.c +++ b/libavcodec/jpeglsdec.c @@ -149,7 +149,7 @@ static inline int ls_get_code_regular(GetBitContext *gb, JLSState *state, int Q) { int k, ret; - for (k = 0; (state->N[Q] << k) < state->A[Q]; k++) + for (k = 0; ((unsigned)state->N[Q] << k) < state->A[Q]; k++) ; #ifdef JLS_BROKEN From patchwork Sun Jan 31 19:18:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25290 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 4903544B7AF for ; Sun, 31 Jan 2021 21:19:28 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 2D845689C22; Sun, 31 Jan 2021 21:19:28 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe01-2.mx.upcmail.net (vie01a-dmta-pe01-2.mx.upcmail.net [62.179.121.155]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 63B52680466 for ; Sun, 31 Jan 2021 21:19:20 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe01.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IFj-000ANz-0O for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:19:19 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IElldmoWO4rA6IEllfTOa; Sun, 31 Jan 2021 20:18:19 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=ZX6obH1OMnzuFoRKY1EA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:12 +0100 Message-Id: <20210131191818.17203-6-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfFNUfD/FF9XsIQf/+hAtZC6UQhqWQ9UMEEJIEq9U8oJIYtqDAjLP5y8dc7GkbDkREIFpSXTc7bm/fGib3mhTm1jbViDmUFHF1GyZxX4Ye44VDxtFJdti Xsi0jx2uRaJSOWC7iCw41SddAR0OQwMr3ytbaGfyeCAtc3taFdc42ZG+ Subject: [FFmpeg-devel] [PATCH 06/12] avformat/mvdec: Check for EOF in read_index() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: Timeout Fixes: 29550/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5094307193290752 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/mvdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mvdec.c b/libavformat/mvdec.c index d8f121bea5..cf5dafe8b2 100644 --- a/libavformat/mvdec.c +++ b/libavformat/mvdec.c @@ -266,6 +266,8 @@ static void read_index(AVIOContext *pb, AVStream *st) uint32_t pos = avio_rb32(pb); uint32_t size = avio_rb32(pb); avio_skip(pb, 8); + if (avio_feof(pb)) + return ; av_add_index_entry(st, pos, timestamp, size, 0, AVINDEX_KEYFRAME); if (st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO) { timestamp += size / (st->codecpar->channels * 2LL); From patchwork Sun Jan 31 19:18:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25298 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 543A3448FBA for ; Sun, 31 Jan 2021 21:20:31 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 31C46689F4D; Sun, 31 Jan 2021 21:20:31 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe03-3.mx.upcmail.net (vie01a-dmta-pe03-3.mx.upcmail.net [62.179.121.162]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 942AE689E56 for ; Sun, 31 Jan 2021 21:20:26 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe03.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IFk-000ADD-0c for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:19:20 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IEmldmpbO4rA6IEmlfTOg; Sun, 31 Jan 2021 20:18:20 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=v8YH5qlYUiI-SvwfprIA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:13 +0100 Message-Id: <20210131191818.17203-7-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfKO4ZPKM4IGzRnFUjB46pYwaz3mzp3dFI0wciANCI3HIF8beqqfPW+VIEHobgFjcZOP1bLBtr9uzRp865ixt6/HViObWykQ6ih+YiWt3zI6IHmAAlpau 5fjKdSriiHQdsUJ3k4ld8H/753P0qvKY4ptQsx4qZbY5gGo/GiMeRo5g Subject: [FFmpeg-devel] [PATCH 07/12] libavutil/eval: Remove CONFIG_TRAPV special handling X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: division by zero Fixes: 29555/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-5149951447400448 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavutil/eval.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavutil/eval.c b/libavutil/eval.c index aaa8eb4945..d0bada9b31 100644 --- a/libavutil/eval.c +++ b/libavutil/eval.c @@ -306,7 +306,7 @@ static double eval_expr(Parser *p, AVExpr *e) double d = eval_expr(p, e->param[0]); double d2 = eval_expr(p, e->param[1]); switch (e->type) { - case e_mod: return e->value * (d - floor((!CONFIG_FTRAPV || d2) ? d / d2 : d * INFINITY) * d2); + case e_mod: return e->value * (d - floor(d2 ? d / d2 : d * INFINITY) * d2); case e_gcd: return e->value * av_gcd(d,d2); case e_max: return e->value * (d > d2 ? d : d2); case e_min: return e->value * (d < d2 ? d : d2); From patchwork Sun Jan 31 19:18:14 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25297 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 22FC3448FBA for ; Sun, 31 Jan 2021 21:20:30 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0E202689C5C; Sun, 31 Jan 2021 21:20:30 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe06-1.mx.upcmail.net (vie01a-dmta-pe06-1.mx.upcmail.net [84.116.36.14]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 3CA4F6899A5 for ; Sun, 31 Jan 2021 21:20:20 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe06.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IGi-000AGe-0C for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:20:20 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IEmldmpqO4rA6IEmlfTOn; Sun, 31 Jan 2021 20:18:20 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=x0mk3qjU5t26rmZpDJwA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:14 +0100 Message-Id: <20210131191818.17203-8-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfKO4ZPKM4IGzRnFUjB46pYwaz3mzp3dFI0wciANCI3HIF8beqqfPW+VIEHobgFjcZOP1bLBtr9uzRp865ixt6/HViObWykQ6ih+YiWt3zI6IHmAAlpau 5fjKdSriiHQdsUJ3k4ld8H/753P0qvKY4ptQsx4qZbY5gGo/GiMeRo5g Subject: [FFmpeg-devel] [PATCH 08/12] avformat/mov: Check for duplicate st3d X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: memleak Fixes: 29585/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6594188688490496 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index ad0b9a58d3..b754789bcb 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5559,6 +5559,10 @@ static int mov_read_st3d(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_log(c->fc, AV_LOG_ERROR, "Empty stereoscopic video box\n"); return AVERROR_INVALIDDATA; } + + if (sc->stereo3d) + return AVERROR_INVALIDDATA; + avio_skip(pb, 4); /* version + flags */ mode = avio_r8(pb); From patchwork Sun Jan 31 19:18:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25300 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 860E7448FBA for ; Sun, 31 Jan 2021 21:20:35 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 7638D68A84E; Sun, 31 Jan 2021 21:20:35 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe03-3.mx.upcmail.net (vie01a-dmta-pe03-3.mx.upcmail.net [62.179.121.162]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 9263968A148 for ; Sun, 31 Jan 2021 21:20:32 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe03.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IFk-0009s8-0b for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:19:20 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IEmldmqBO4rA6IEmlfTOz; Sun, 31 Jan 2021 20:18:20 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=KN_L95zk1yjUvWBcPREA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:15 +0100 Message-Id: <20210131191818.17203-9-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfKO4ZPKM4IGzRnFUjB46pYwaz3mzp3dFI0wciANCI3HIF8beqqfPW+VIEHobgFjcZOP1bLBtr9uzRp865ixt6/HViObWykQ6ih+YiWt3zI6IHmAAlpau 5fjKdSriiHQdsUJ3k4ld8H/753P0qvKY4ptQsx4qZbY5gGo/GiMeRo5g Subject: [FFmpeg-devel] [PATCH 09/12] avformat/avidec: Use 64bit in get_duration() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: signed integer overflow: 2147483424 + 8224 cannot be represented in type 'int' Fixes: 29619/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5191424373030912 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/avidec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 79000f3e81..547eb63b1b 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -135,7 +135,7 @@ static inline int get_duration(AVIStream *ast, int len) if (ast->sample_size) return len; else if (ast->dshow_block_align) - return (len + ast->dshow_block_align - 1) / ast->dshow_block_align; + return (len + (int64_t)ast->dshow_block_align - 1) / ast->dshow_block_align; else return 1; } From patchwork Sun Jan 31 19:18:16 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25292 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 6792244B7AF for ; Sun, 31 Jan 2021 21:19:30 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 54FB6689BC9; Sun, 31 Jan 2021 21:19:30 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe01-2.mx.upcmail.net (vie01a-dmta-pe01-2.mx.upcmail.net [62.179.121.155]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6AD93689A63 for ; Sun, 31 Jan 2021 21:19:20 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe01.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IFk-0008XX-0e for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:19:20 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IEmldmqQO4rA6IEmlfTP7; Sun, 31 Jan 2021 20:18:20 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=vCkhOamYvzdd8XXRJfkA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:16 +0100 Message-Id: <20210131191818.17203-10-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfKO4ZPKM4IGzRnFUjB46pYwaz3mzp3dFI0wciANCI3HIF8beqqfPW+VIEHobgFjcZOP1bLBtr9uzRp865ixt6/HViObWykQ6ih+YiWt3zI6IHmAAlpau 5fjKdSriiHQdsUJ3k4ld8H/753P0qvKY4ptQsx4qZbY5gGo/GiMeRo5g Subject: [FFmpeg-devel] [PATCH 10/12] avcodec/mobiclip: Bound planar prediction value X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Alternatively we could wrap around or error out. Wrap around would look most messy as downstream computations would need to wrap as well. I did not find a official specification which would list what to do with huge values. Fixes: signed integer overflow: 2 * 1073741952 cannot be represented in type 'int' Fixes: 26765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-6594926936326144 Fixes: 29663/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5169789012148224 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/mobiclip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c index 94368c20e8..a15091426a 100644 --- a/libavcodec/mobiclip.c +++ b/libavcodec/mobiclip.c @@ -848,7 +848,7 @@ static int predict_intra(AVCodecContext *avctx, AVFrame *frame, int ax, int ay, uint8_t *left = frame->data[plane] + ay * frame->linesize[plane] + FFMAX(ax - 1, 0); int bottommost = frame->data[plane][(ay + size - 1) * frame->linesize[plane] + FFMAX(ax - 1, 0)]; int rightmost = frame->data[plane][FFMAX(ay - 1, 0) * frame->linesize[plane] + ax + size - 1]; - int avg = (bottommost + rightmost + 1) / 2 + 2 * get_se_golomb(gb); + int avg = (bottommost + rightmost + 1) / 2 + 2 * av_clip(get_se_golomb(gb), -(1<<16), 1<<16); int r6 = adjust(avg - bottommost, size); int r9 = adjust(avg - rightmost, size); int shift = adjust(size, size) == 8 ? 3 : 2; From patchwork Sun Jan 31 19:18:17 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25291 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 5829444B7AF for ; Sun, 31 Jan 2021 21:19:29 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 30816689C96; Sun, 31 Jan 2021 21:19:29 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe01-2.mx.upcmail.net (vie01a-dmta-pe01-2.mx.upcmail.net [62.179.121.155]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 689526899A5 for ; Sun, 31 Jan 2021 21:19:20 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe01.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IFk-000Abt-0e for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:19:20 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IEmldmqbO4rA6IEmlfTPB; Sun, 31 Jan 2021 20:18:20 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=MCWH875QK1aQfun5hX4A:9 a=0bXxn9q0MV6snEgNplNhOjQmxlI=:19 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=QOGEsqRv6VhmHaoFNykA:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:17 +0100 Message-Id: <20210131191818.17203-11-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfKO4ZPKM4IGzRnFUjB46pYwaz3mzp3dFI0wciANCI3HIF8beqqfPW+VIEHobgFjcZOP1bLBtr9uzRp865ixt6/HViObWykQ6ih+YiWt3zI6IHmAAlpau 5fjKdSriiHQdsUJ3k4ld8H/753P0qvKY4ptQsx4qZbY5gGo/GiMeRo5g Subject: [FFmpeg-devel] [PATCH 11/12] avcodec/jpeg2000dec: Check atom_size in jp2_find_codestream() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: Infinite loop Fixes: 29722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6412228041506816 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/jpeg2000dec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 624542c2f8..63edbcda09 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -2342,8 +2342,12 @@ static int jp2_find_codestream(Jpeg2000DecoderContext *s) return 0; } atom_size = bytestream2_get_be32u(&s->g); + if (atom_size < 16 || (int64_t)bytestream2_tell(&s->g) + atom_size - 16 > INT_MAX) + return AVERROR_INVALIDDATA; atom_end = bytestream2_tell(&s->g) + atom_size - 16; } else { + if (atom_size < 8 || (int64_t)bytestream2_tell(&s->g) + atom_size - 8 > INT_MAX) + return AVERROR_INVALIDDATA; atom_end = bytestream2_tell(&s->g) + atom_size - 8; } From patchwork Sun Jan 31 19:18:18 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25296 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 03626448FBA for ; Sun, 31 Jan 2021 21:20:29 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id D0958689DC4; Sun, 31 Jan 2021 21:20:28 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe06-1.mx.upcmail.net (vie01a-dmta-pe06-1.mx.upcmail.net [84.116.36.14]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 3C809688189 for ; Sun, 31 Jan 2021 21:20:20 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe06.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1l6IGi-000AGf-0C for ffmpeg-devel@ffmpeg.org; Sun, 31 Jan 2021 20:20:20 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id 6IEmldmqjO4rA6IEmlfTPF; Sun, 31 Jan 2021 20:18:20 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=RNDN4Lq+ c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=YxiH8IUN0JBz9W9VygEA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 31 Jan 2021 20:18:18 +0100 Message-Id: <20210131191818.17203-12-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210131191818.17203-1-michael@niedermayer.cc> References: <20210131191818.17203-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfKO4ZPKM4IGzRnFUjB46pYwaz3mzp3dFI0wciANCI3HIF8beqqfPW+VIEHobgFjcZOP1bLBtr9uzRp865ixt6/HViObWykQ6ih+YiWt3zI6IHmAAlpau 5fjKdSriiHQdsUJ3k4ld8H/753P0qvKY4ptQsx4qZbY5gGo/GiMeRo5g Subject: [FFmpeg-devel] [PATCH 12/12] avformat/samidec: Sanity check pts X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long' Fixes: 29743/clusterfuzz-testcase-minimized-ffmpeg_dem_SAMI_fuzzer-5499256859394048 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/samidec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/samidec.c b/libavformat/samidec.c index 3070ef9bac..cf5076c7b8 100644 --- a/libavformat/samidec.c +++ b/libavformat/samidec.c @@ -95,6 +95,11 @@ static int sami_read_header(AVFormatContext *s) const char *p = ff_smil_get_attr_ptr(buf.str, "Start"); sub->pos = pos; sub->pts = p ? strtol(p, NULL, 10) : 0; + if (sub->pts <= INT64_MIN/2 || sub->pts >= INT64_MAX/2) { + res = AVERROR_PATCHWELCOME; + goto end; + } + sub->duration = -1; } }