From patchwork Mon Feb 15 20:23:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25647 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id C63E6449E4A for ; Mon, 15 Feb 2021 22:30:57 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id ADAF2688128; Mon, 15 Feb 2021 22:30:57 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe01-3.mx.upcmail.net (vie01a-dmta-pe01-3.mx.upcmail.net [62.179.121.156]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 23B16687F93 for ; Mon, 15 Feb 2021 22:30:51 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe01.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1lBkPm-000A7a-07 for ffmpeg-devel@ffmpeg.org; Mon, 15 Feb 2021 21:24:14 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id BkOnlf8WYljeHBkOol2KJr; Mon, 15 Feb 2021 21:23:14 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=BoHjPrf5 c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=fjMlPbp-JQQqRZ-RrEIA:9 a=+jEqtf1s3R9VXZ0wqowq2kgwd+I=:19 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Mon, 15 Feb 2021 21:23:11 +0100 Message-Id: <20210215202313.1228-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 X-CMAE-Envelope: MS4wfKNjYSSOl4swzD65re4VuxDhHJk8+6AdPBELtnV5CNENhElUhe0nhuj4luNL12pziOPJtfBXaXV1kC13FqYAsElLjXu/xMcX1UOs87OtCmEfi+tQ/gBb axdJQeFnaGHtYTCArg0ebJ0Od5W1pEOIDgVd+stw9WY3WkHHtCA4wxsG Subject: [FFmpeg-devel] [PATCH 1/3] avcodec/vp8: Move end check into MB loop in vp78_decode_mv_mb_modes() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: Timeout (long -> 5sec) Fixes: 30269/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP7_fuzzer-5430325004075008 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/vp8.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index 5fa7971f8f..89c48e6cb1 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -2293,10 +2293,10 @@ int vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe, s->mv_bounds.mv_min.x = -MARGIN; s->mv_bounds.mv_max.x = ((s->mb_width - 1) << 6) + MARGIN; - if (vpX_rac_is_end(&s->c)) { - return AVERROR_INVALIDDATA; - } for (mb_x = 0; mb_x < s->mb_width; mb_x++, mb_xy++, mb++) { + if (vpX_rac_is_end(&s->c)) { + return AVERROR_INVALIDDATA; + } if (mb_y == 0) AV_WN32A((mb - s->mb_width - 1)->intra4x4_pred_mode_top, DC_PRED * 0x01010101); From patchwork Mon Feb 15 20:23:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25646 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 7364044A541 for ; Mon, 15 Feb 2021 22:29:30 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 3D6616880EF; Mon, 15 Feb 2021 22:29:30 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe01-3.mx.upcmail.net (vie01a-dmta-pe01-3.mx.upcmail.net [62.179.121.156]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 986F26809CD for ; Mon, 15 Feb 2021 22:29:23 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe01.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1lBkPm-000ANc-07 for ffmpeg-devel@ffmpeg.org; Mon, 15 Feb 2021 21:24:14 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id BkOolf8XFljeHBkOol2KK2; Mon, 15 Feb 2021 21:23:14 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=BoHjPrf5 c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=qX5wZS9MHFB6eZLz2DQA:9 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=SsAZrZ5W_gNWK9tOzrEV:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Mon, 15 Feb 2021 21:23:12 +0100 Message-Id: <20210215202313.1228-2-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210215202313.1228-1-michael@niedermayer.cc> References: <20210215202313.1228-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfKNjYSSOl4swzD65re4VuxDhHJk8+6AdPBELtnV5CNENhElUhe0nhuj4luNL12pziOPJtfBXaXV1kC13FqYAsElLjXu/xMcX1UOs87OtCmEfi+tQ/gBb axdJQeFnaGHtYTCArg0ebJ0Od5W1pEOIDgVd+stw9WY3WkHHtCA4wxsG Subject: [FFmpeg-devel] [PATCH 2/3] avformat/mov: Check element count in mov_metadata_hmmt() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: Timeout Fixes: 30325/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6048395703746560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 9ca0a3ee15..2a701e9f70 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -288,6 +288,8 @@ static int mov_metadata_hmmt(MOVContext *c, AVIOContext *pb, unsigned len) return 0; n_hmmt = avio_rb32(pb); + if (n_hmmt > len / 4) + return AVERROR_INVALIDDATA; for (i = 0; i < n_hmmt && !pb->eof_reached; i++) { int moment_time = avio_rb32(pb); avpriv_new_chapter(c->fc, i, av_make_q(1, 1000), moment_time, AV_NOPTS_VALUE, NULL); From patchwork Mon Feb 15 20:23:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 25649 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id C130F44A3EA for ; Mon, 15 Feb 2021 22:31:23 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id A6585688188; Mon, 15 Feb 2021 22:31:23 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe03-1.mx.upcmail.net (vie01a-dmta-pe03-1.mx.upcmail.net [62.179.121.160]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 4363268064D for ; Mon, 15 Feb 2021 22:31:17 +0200 (EET) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe03.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1lBkPm-0006dY-06 for ffmpeg-devel@ffmpeg.org; Mon, 15 Feb 2021 21:24:14 +0100 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id BkOolf8XOljeHBkOol2KK6; Mon, 15 Feb 2021 21:23:14 +0100 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=BoHjPrf5 c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=nZOtpAppAAAA:20 a=KWtg-Q6Zjhry-gZtepQA:9 a=mDMCCDcF96zK9S6P:21 a=6d0MnrHgV1Jhs7MF:21 a=1fhp2MxaeJtTNGEnv6mo:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22 a=UDnyf2zBuKT2w-IlGP_r:22 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Mon, 15 Feb 2021 21:23:13 +0100 Message-Id: <20210215202313.1228-3-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210215202313.1228-1-michael@niedermayer.cc> References: <20210215202313.1228-1-michael@niedermayer.cc> X-CMAE-Envelope: MS4wfKNjYSSOl4swzD65re4VuxDhHJk8+6AdPBELtnV5CNENhElUhe0nhuj4luNL12pziOPJtfBXaXV1kC13FqYAsElLjXu/xMcX1UOs87OtCmEfi+tQ/gBb axdJQeFnaGHtYTCArg0ebJ0Od5W1pEOIDgVd+stw9WY3WkHHtCA4wxsG Subject: [FFmpeg-devel] [PATCH 3/3] avformat/rmdec: Check codec_length without overflow X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int' Fixes: 30333/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5175286983426048 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/rmdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 521b9d0e8c..613fb407df 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -223,7 +223,7 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, if (version == 5) avio_r8(pb); codecdata_length = avio_rb32(pb); - if(codecdata_length + AV_INPUT_BUFFER_PADDING_SIZE <= (unsigned)codecdata_length){ + if(codecdata_length < 0 || codecdata_length > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE){ av_log(s, AV_LOG_ERROR, "codecdata_length too large\n"); return -1; }