[FFmpeg-devel] [PATCH] libavformat/svs.c: Numeric Truncation in svs.c:57. Added a checker for valid sample_rate value.

2023-10-02 Thread mezhuevtp 
From: headshog 

---
 libavformat/svs.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavformat/svs.c b/libavformat/svs.c
index b91d29f5a6..bdfb856184 100644
--- a/libavformat/svs.c
+++ b/libavformat/svs.c
@@ -42,6 +42,7 @@ static int svs_read_header(AVFormatContext *s)
 {
 AVStream *st;
 uint32_t pitch;
+int64_t rescale_val;
 
 st = avformat_new_stream(s, NULL);
 if (!st)
@@ -51,10 +52,14 @@ static int svs_read_header(AVFormatContext *s)
 pitch = avio_rl32(s->pb);
 avio_skip(s->pb, 12);
 
+rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+if (rescale_val > INT_MAX)
+return AVERROR(ERANGE);
+
 st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
 st->codecpar->codec_id   = AV_CODEC_ID_ADPCM_PSX;
 st->codecpar->ch_layout  = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
-st->codecpar->sample_rate= av_rescale_rnd(pitch, 48000, 4096, 
AV_ROUND_INF);
+st->codecpar->sample_rate= rescale_val;
 st->codecpar->block_align= 32;
 st->start_time   = 0;
 if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
-- 
2.25.1

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH] libavformat/svs.c Fixed, now it is in the right place.

2023-09-25 Thread mezhuevtp 
From: headshog 

---
 libavformat/svs.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavformat/svs.c b/libavformat/svs.c
index b91d29f5a6..bdfb856184 100644
--- a/libavformat/svs.c
+++ b/libavformat/svs.c
@@ -42,6 +42,7 @@ static int svs_read_header(AVFormatContext *s)
 {
 AVStream *st;
 uint32_t pitch;
+int64_t rescale_val;
 
 st = avformat_new_stream(s, NULL);
 if (!st)
@@ -51,10 +52,14 @@ static int svs_read_header(AVFormatContext *s)
 pitch = avio_rl32(s->pb);
 avio_skip(s->pb, 12);
 
+rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+if (rescale_val > INT_MAX)
+return AVERROR(ERANGE);
+
 st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
 st->codecpar->codec_id   = AV_CODEC_ID_ADPCM_PSX;
 st->codecpar->ch_layout  = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
-st->codecpar->sample_rate= av_rescale_rnd(pitch, 48000, 4096, 
AV_ROUND_INF);
+st->codecpar->sample_rate= rescale_val;
 st->codecpar->block_align= 32;
 st->start_time   = 0;
 if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
-- 
2.25.1

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH] libavformat\svs.c: Fixed, not it is in the right place

2023-09-25 Thread mezhuevtp 
From: headshog 

---
 0001-Fixed-not-it-is-in-the-right-place.patch | 89 +++
 0001-Numeric-truncation-in-svs.c-57.patch | 41 +
 libavformat/svs.c |  7 +-
 3 files changed, 136 insertions(+), 1 deletion(-)
 create mode 100644 0001-Fixed-not-it-is-in-the-right-place.patch
 create mode 100644 0001-Numeric-truncation-in-svs.c-57.patch

diff --git a/0001-Fixed-not-it-is-in-the-right-place.patch 
b/0001-Fixed-not-it-is-in-the-right-place.patch
new file mode 100644
index 00..8373c56851
--- /dev/null
+++ b/0001-Fixed-not-it-is-in-the-right-place.patch
@@ -0,0 +1,89 @@
+From ea89215a6b5627f73c370381f07a87f1ccb146ea Mon Sep 17 00:00:00 2001
+From: headshog 
+Date: Mon, 25 Sep 2023 14:38:04 +0300
+Subject: [PATCH] Fixed, not it is in the right place.
+
+---
+ 0001-Numeric-truncation-in-svs.c-57.patch | 41 +++
+ libavformat/svs.c |  7 +++-
+ 2 files changed, 47 insertions(+), 1 deletion(-)
+ create mode 100644 0001-Numeric-truncation-in-svs.c-57.patch
+
+diff --git a/0001-Numeric-truncation-in-svs.c-57.patch 
b/0001-Numeric-truncation-in-svs.c-57.patch
+new file mode 100644
+index 00..dbfdf07e6f
+--- /dev/null
 b/0001-Numeric-truncation-in-svs.c-57.patch
+@@ -0,0 +1,41 @@
++From a9b235e392024f1877d5c43fc0129e9eebb6aea2 Mon Sep 17 00:00:00 2001
++From: headshog 
++Date: Mon, 25 Sep 2023 12:48:22 +0300
++Subject: [PATCH] Numeric truncation in svs.c:57
++
++Hi! We've been fuzzing `ffmpeg` with 
[sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we 
found numeric truncation error in `svs.c:57`.
++In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` 
has type `int`, the type of return value in `av_rescale_rnd` function is 
`int64_t`, so the numeric truncation may occur here.
++Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` 
function parameter `unsgined int pts_den`.
++In a way not to break API/ABI, I've added a checker for valid `sample_rate` 
value.
++---
++ libavformat/svs.c | 7 ++-
++ 1 file changed, 6 insertions(+), 1 deletion(-)
++
++diff --git a/libavformat/svs.c b/libavformat/svs.c
++index b91d29f5a6..54f24f539c 100644
++--- a/libavformat/svs.c
+ b/libavformat/svs.c
++@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
++ {
++ AVStream *st;
++ uint32_t pitch;
+++int64_t rescale_val;
+++
+++rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+++if (rescale_val > INT_MAX)
+++return AVERROR(ERANGE);
++ 
++ st = avformat_new_stream(s, NULL);
++ if (!st)
++@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
++ st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
++ st->codecpar->codec_id   = AV_CODEC_ID_ADPCM_PSX;
++ st->codecpar->ch_layout  = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
++-st->codecpar->sample_rate= av_rescale_rnd(pitch, 48000, 4096, 
AV_ROUND_INF);
+++st->codecpar->sample_rate= rescale_val;
++ st->codecpar->block_align= 32;
++ st->start_time   = 0;
++ if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
++-- 
++2.25.1
++
+diff --git a/libavformat/svs.c b/libavformat/svs.c
+index b91d29f5a6..bdfb856184 100644
+--- a/libavformat/svs.c
 b/libavformat/svs.c
+@@ -42,6 +42,7 @@ static int svs_read_header(AVFormatContext *s)
+ {
+ AVStream *st;
+ uint32_t pitch;
++int64_t rescale_val;
+ 
+ st = avformat_new_stream(s, NULL);
+ if (!st)
+@@ -51,10 +52,14 @@ static int svs_read_header(AVFormatContext *s)
+ pitch = avio_rl32(s->pb);
+ avio_skip(s->pb, 12);
+ 
++rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++if (rescale_val > INT_MAX)
++return AVERROR(ERANGE);
++
+ st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
+ st->codecpar->codec_id   = AV_CODEC_ID_ADPCM_PSX;
+ st->codecpar->ch_layout  = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
+-st->codecpar->sample_rate= av_rescale_rnd(pitch, 48000, 4096, 
AV_ROUND_INF);
++st->codecpar->sample_rate= rescale_val;
+ st->codecpar->block_align= 32;
+ st->start_time   = 0;
+ if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
+-- 
+2.25.1
+
diff --git a/0001-Numeric-truncation-in-svs.c-57.patch 
b/0001-Numeric-truncation-in-svs.c-57.patch
new file mode 100644
index 00..dbfdf07e6f
--- /dev/null
+++ b/0001-Numeric-truncation-in-svs.c-57.patch
@@ -0,0 +1,41 @@
+From a9b235e392024f1877d5c43fc0129e9eebb6aea2 Mon Sep 17 00:00:00 2001
+From: headshog 
+Date: Mon, 25 Sep 2023 12:48:22 +0300
+Subject: [PATCH] Numeric truncation in svs.c:57
+
+Hi! We've been fuzzing `ffmpeg` with 
[sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we 
found numeric truncation error in `svs.c:57`.
+In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has 
type `int`, the type of return value in

[FFmpeg-devel] [PATCH] Numeric truncation in svs.c:57

2023-09-25 Thread mezhuevtp 
From: headshog 

Hi! We've been fuzzing `ffmpeg` with 
[sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we 
found numeric truncation error in `svs.c:57`.
In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has 
type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, 
so the numeric truncation may occur here.
Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` 
function parameter `unsgined int pts_den`.
In a way not to break API/ABI, I've added a checker for valid `sample_rate` 
value.
---
 libavformat/svs.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavformat/svs.c b/libavformat/svs.c
index b91d29f5a6..54f24f539c 100644
--- a/libavformat/svs.c
+++ b/libavformat/svs.c
@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
 {
 AVStream *st;
 uint32_t pitch;
+int64_t rescale_val;
+
+rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+if (rescale_val > INT_MAX)
+return AVERROR(ERANGE);
 
 st = avformat_new_stream(s, NULL);
 if (!st)
@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
 st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
 st->codecpar->codec_id   = AV_CODEC_ID_ADPCM_PSX;
 st->codecpar->ch_layout  = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
-st->codecpar->sample_rate= av_rescale_rnd(pitch, 48000, 4096, 
AV_ROUND_INF);
+st->codecpar->sample_rate= rescale_val;
 st->codecpar->block_align= 32;
 st->start_time   = 0;
 if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
-- 
2.25.1

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.

2023-09-20 Thread mezhuevtp 

On 2023-09-20 15:29, Paul B Mahol wrote:

Unacceptable code changes as that Breaks ABI/API.
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".


Maybe then a checker for valid sample_rate value should be added to 
svs_read_header function?

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH] Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.

2023-09-20 Thread mezhuevtp 
From: headshog 

In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has 
type `int`, the type of return value in `av_rescale_rnd` function is 
`uint64_t`, so the numeric truncation may occur here. Then value of 
`st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function 
parameter `unsgined int pts_den`. In this function `pts_den` is used only in 
passing its value to parameter `int64_t den` in function `av_reduce`. So we 
suggest to change the type of field `sample_rate` to `int64_t` and to change 
the type of `pts_den` to `uint64_t` in `avpriv_set_pts_info` function. The 
other way to solve this is to add a checker for `sample_rate` valid value.

- OS: ubuntu 20.04
- commit: f225f8d7464569c7b917015c26ad30a37a5fbbe2

```
libavformat/svs.c:57:36: runtime error: implicit conversion from type 'int64_t' 
(aka 'long') of value 6321554672 (64-bit, signed) to type 'int' changed the 
value to 2026587376 (32-bit, signed)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavformat/svs.c:57:36
```
---
 libavcodec/codec_par.h | 2 +-
 libavformat/internal.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/codec_par.h b/libavcodec/codec_par.h
index add90fdb1e..2bbb7ba4e7 100644
--- a/libavcodec/codec_par.h
+++ b/libavcodec/codec_par.h
@@ -175,7 +175,7 @@ typedef struct AVCodecParameters {
 /**
  * Audio only. The number of audio samples per second.
  */
-int  sample_rate;
+int64_t  sample_rate;
 /**
  * Audio only. The number of bytes per coded audio frame, required by some
  * formats.
diff --git a/libavformat/internal.h b/libavformat/internal.h
index 901a8b51c6..6e1fce41aa 100644
--- a/libavformat/internal.h
+++ b/libavformat/internal.h
@@ -584,7 +584,7 @@ const struct AVCodec *ff_find_decoder(AVFormatContext *s, 
const AVStream *st,
  * @param pts_den time base denominator
  */
 void avpriv_set_pts_info(AVStream *st, int pts_wrap_bits,
- unsigned int pts_num, unsigned int pts_den);
+ unsigned int pts_num, uint64_t pts_den);
 
 /**
  * Set the timebase for each stream from the corresponding codec timebase and
-- 
2.25.1

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".