PR #20855 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20855 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20855.patch
>From 5ccb2c9934615db1d55a7a62dda551c4d02c6fd6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 7 Nov 2025 01:47:40 +0100 Subject: [PATCH 1/3] avcodec/prores_raw: Prettify ff_prores_raw_*_cb the values contain 3 4 bit values, thus using hex is more natural and shows more information Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/prores_raw.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c index 0298956efd..f293e489bc 100644 --- a/libavcodec/prores_raw.c +++ b/libavcodec/prores_raw.c @@ -101,30 +101,30 @@ static const uint8_t align_tile_w[16] = { #define DC_CB_MAX 12 const uint8_t ff_prores_raw_dc_cb[DC_CB_MAX + 1] = { - 16, 33, 50, 51, 51, 51, 68, 68, 68, 68, 68, 68, 118, + 0x010, 0x021, 0x032, 0x033, 0x033, 0x033, 0x044, 0x044, 0x044, 0x044, 0x044, 0x044, 0x076, }; #define AC_CB_MAX 94 const int16_t ff_prores_raw_ac_cb[AC_CB_MAX + 1] = { - 0, 529, 273, 273, 546, 546, 546, 290, 290, 290, 563, 563, - 563, 563, 563, 563, 563, 563, 307, 307, 580, 580, 580, 580, - 580, 580, 580, 580, 580, 580, 580, 580, 580, 580, 580, 580, - 580, 580, 580, 580, 580, 580, 853, 853, 853, 853, 853, 853, - 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, - 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, - 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, - 853, 853, 853, 853, 853, 853, 853, 853, 853, 853, 358 + 0x000, 0x211, 0x111, 0x111, 0x222, 0x222, 0x222, 0x122, 0x122, 0x122, + 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x133, 0x133, + 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, + 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, 0x244, + 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, + 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, + 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, + 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x355, 0x166, }; #define RN_CB_MAX 27 const int16_t ff_prores_raw_rn_cb[RN_CB_MAX + 1] = { - 512, 256, 0, 0, 529, 529, 273, 273, 17, 17, 33, 33, 546, - 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, 50, 50, 68, + 0x200, 0x100, 0x000, 0x000, 0x211, 0x211, 0x111, 0x111, 0x011, 0x011, 0x021, 0x021, 0x222, 0x022, + 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x022, 0x032, 0x032, 0x044 }; #define LN_CB_MAX 14 const int16_t ff_prores_raw_ln_cb[LN_CB_MAX + 1] = { - 256, 273, 546, 546, 290, 290, 1075, 1075, 563, 563, 563, 563, 563, 563, 51 + 0x100, 0x111, 0x222, 0x222, 0x122, 0x122, 0x433, 0x433, 0x233, 0x233, 0x233, 0x233, 0x233, 0x233, 0x033, }; static int decode_comp(AVCodecContext *avctx, TileContext *tile, -- 2.49.1 >From 2620c7dc76234dc1e9d0ece586a607e680d82e76 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 7 Nov 2025 01:53:17 +0100 Subject: [PATCH 2/3] avcodec/prores_raw: Check bits in get_value() The code loads 32bit so we can at maximum use 32bit Fixes: runtime error: shift exponent -9 is negative Fixes: 439483046/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_RAW_DEC_fuzzer-6649466540326912 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/prores_raw.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c index f293e489bc..7d78a043b1 100644 --- a/libavcodec/prores_raw.c +++ b/libavcodec/prores_raw.c @@ -87,6 +87,8 @@ static int16_t get_value(GetBitContext *gb, int16_t codebook) } bits = exp_order + (q << 1) - switch_bits; + if (bits > 32) + return -1; skip_bits_long(gb, bits); return (b >> (32 - bits)) + ((switch_bits + 1) << rice_order) - -- 2.49.1 >From 375a4fd43300674d9b251be203f38593215ca5c1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 7 Nov 2025 01:55:39 +0100 Subject: [PATCH 3/3] avcodec/prores_raw: Check get_value() return code Fixes: out of array access Fixes: 439483046/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_RAW_DEC_fuzzer-6649466540326912 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/prores_raw.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c index 7d78a043b1..ceee757420 100644 --- a/libavcodec/prores_raw.c +++ b/libavcodec/prores_raw.c @@ -171,6 +171,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, /* Special handling for first block */ int dc = get_value(&gb, 700); + if (dc < 0) + return AVERROR_INVALIDDATA; int prev_dc = (dc >> 1) ^ -(dc & 1); block[0] = (((dc&1) + (dc>>1) ^ -(int)(dc & 1)) + (dc & 1)) + 1; @@ -184,6 +186,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, dc_codebook = ff_prores_raw_dc_cb[FFMIN(TODCCODEBOOK(dc), DC_CB_MAX)]; dc = get_value(&gb, dc_codebook); + if (dc < 0) + break; sign = sign ^ dc & 1; dc_add = (-sign ^ TODCCODEBOOK(dc)) + sign; @@ -198,6 +202,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, break; ln = get_value(&gb, ln_codebook); + if (ln < 0) + break; for (int i = 0; i < ln; i++) { if (get_bits_left(&gb) <= 0) @@ -207,6 +213,9 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, break; ac = get_value(&gb, ac_codebook); + if (ac < 0) + break; + ac_codebook = ff_prores_raw_ac_cb[FFMIN(ac, AC_CB_MAX)]; sign = -get_bits1(&gb); @@ -219,6 +228,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, break; rn = get_value(&gb, rn_codebook); + if (rn < 0) + break; rn_codebook = ff_prores_raw_rn_cb[FFMIN(rn, RN_CB_MAX)]; n += rn + 1; @@ -229,6 +240,8 @@ static int decode_comp(AVCodecContext *avctx, TileContext *tile, break; ac = get_value(&gb, ac_codebook); + if (ac < 0) + break; sign = -get_bits1(&gb); idx = scan[n >> log2_nb_blocks] + ((n & block_mask) << 6); -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
