Re: [FFmpeg-devel] [PATCH 1/2] avcodec/hdrdec: Check for end of input in decompress()
On Mon, Dec 26, 2022 at 03:08:38PM +0100, Paul B Mahol wrote: > On 12/25/22, Michael Niedermayer wrote: > > Fixes: Timeout > > Fixes: > > 54386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5053598268784640 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer > > --- > > libavcodec/hdrdec.c | 14 +++--- > > 1 file changed, 11 insertions(+), 3 deletions(-) > > > > diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c > > index 21d3e7f693..998227744b 100644 > > --- a/libavcodec/hdrdec.c > > +++ b/libavcodec/hdrdec.c > > @@ -58,6 +58,8 @@ static int decompress(uint8_t *scanline, int w, > > GetByteContext *gb, const uint8_ > > int rshift = 0; > > > > while (w > 0) { > > +if (bytestream2_get_bytes_left(gb) < 4) > > +return AVERROR_INVALIDDATA; > > scanline[0] = bytestream2_get_byte(gb); > > scanline[1] = bytestream2_get_byte(gb); > > scanline[2] = bytestream2_get_byte(gb); > > @@ -143,13 +145,17 @@ static int hdr_decode_frame(AVCodecContext *avctx, > > AVFrame *p, > > int i; > > > > if (width < MINELEN || width > MAXELEN) { > > -decompress(scanline, width, , scanline); > > +ret = decompress(scanline, width, , scanline); > > +if (ret < 0) > > +return ret; > > goto convert; > > } > > > > i = bytestream2_peek_byte(); > > if (i != 2) { > > -decompress(scanline, width, , scanline); > > +ret = decompress(scanline, width, , scanline); > > +if (ret < 0) > > +return ret; > > goto convert; > > } > > bytestream2_skip(, 1); > > @@ -161,7 +167,9 @@ static int hdr_decode_frame(AVCodecContext *avctx, > > AVFrame *p, > > if (scanline[1] != 2 || scanline[2] & 128) { > > scanline[0] = 2; > > scanline[3] = i; > > -decompress(scanline + 4, width - 1, , scanline); > > +ret = decompress(scanline + 4, width - 1, , scanline); > > +if (ret < 0) > > +return ret; > > goto convert; > > } > > > > -- > > 2.17.1 > > > > LGTM will apply thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws. -- Plato signature.asc Description: PGP signature ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 1/2] avcodec/hdrdec: Check for end of input in decompress()
On 12/25/22, Michael Niedermayer wrote: > Fixes: Timeout > Fixes: > 54386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5053598268784640 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer > --- > libavcodec/hdrdec.c | 14 +++--- > 1 file changed, 11 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c > index 21d3e7f693..998227744b 100644 > --- a/libavcodec/hdrdec.c > +++ b/libavcodec/hdrdec.c > @@ -58,6 +58,8 @@ static int decompress(uint8_t *scanline, int w, > GetByteContext *gb, const uint8_ > int rshift = 0; > > while (w > 0) { > +if (bytestream2_get_bytes_left(gb) < 4) > +return AVERROR_INVALIDDATA; > scanline[0] = bytestream2_get_byte(gb); > scanline[1] = bytestream2_get_byte(gb); > scanline[2] = bytestream2_get_byte(gb); > @@ -143,13 +145,17 @@ static int hdr_decode_frame(AVCodecContext *avctx, > AVFrame *p, > int i; > > if (width < MINELEN || width > MAXELEN) { > -decompress(scanline, width, , scanline); > +ret = decompress(scanline, width, , scanline); > +if (ret < 0) > +return ret; > goto convert; > } > > i = bytestream2_peek_byte(); > if (i != 2) { > -decompress(scanline, width, , scanline); > +ret = decompress(scanline, width, , scanline); > +if (ret < 0) > +return ret; > goto convert; > } > bytestream2_skip(, 1); > @@ -161,7 +167,9 @@ static int hdr_decode_frame(AVCodecContext *avctx, > AVFrame *p, > if (scanline[1] != 2 || scanline[2] & 128) { > scanline[0] = 2; > scanline[3] = i; > -decompress(scanline + 4, width - 1, , scanline); > +ret = decompress(scanline + 4, width - 1, , scanline); > +if (ret < 0) > +return ret; > goto convert; > } > > -- > 2.17.1 > LGTM > ___ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe". > ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 1/2] avcodec/hdrdec: Check for end of input in decompress()
Fixes: Timeout Fixes: 54386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5053598268784640 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/hdrdec.c | 14 +++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c index 21d3e7f693..998227744b 100644 --- a/libavcodec/hdrdec.c +++ b/libavcodec/hdrdec.c @@ -58,6 +58,8 @@ static int decompress(uint8_t *scanline, int w, GetByteContext *gb, const uint8_ int rshift = 0; while (w > 0) { +if (bytestream2_get_bytes_left(gb) < 4) +return AVERROR_INVALIDDATA; scanline[0] = bytestream2_get_byte(gb); scanline[1] = bytestream2_get_byte(gb); scanline[2] = bytestream2_get_byte(gb); @@ -143,13 +145,17 @@ static int hdr_decode_frame(AVCodecContext *avctx, AVFrame *p, int i; if (width < MINELEN || width > MAXELEN) { -decompress(scanline, width, , scanline); +ret = decompress(scanline, width, , scanline); +if (ret < 0) +return ret; goto convert; } i = bytestream2_peek_byte(); if (i != 2) { -decompress(scanline, width, , scanline); +ret = decompress(scanline, width, , scanline); +if (ret < 0) +return ret; goto convert; } bytestream2_skip(, 1); @@ -161,7 +167,9 @@ static int hdr_decode_frame(AVCodecContext *avctx, AVFrame *p, if (scanline[1] != 2 || scanline[2] & 128) { scanline[0] = 2; scanline[3] = i; -decompress(scanline + 4, width - 1, , scanline); +ret = decompress(scanline + 4, width - 1, , scanline); +if (ret < 0) +return ret; goto convert; } -- 2.17.1 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".