Re: [FFmpeg-devel] [PATCH 1/2] avcodec/wavpack: Check rate_x and sample rate for overflow
On Sun, May 03, 2020 at 04:13:47PM -0700, David Bryant wrote: > On 5/2/20 2:08 PM, Michael Niedermayer wrote: > > Fixes: shift exponent 32 is too large for 32-bit type 'int' > > Fixes: > > 21647/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5686168323883008 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer > > --- > > libavcodec/wavpack.c | 13 ++--- > > 1 file changed, 10 insertions(+), 3 deletions(-) > > > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > > index 58ab561a15..ead57063c8 100644 > > --- a/libavcodec/wavpack.c > > +++ b/libavcodec/wavpack.c > > @@ -1359,7 +1359,10 @@ static int wavpack_decode_block(AVCodecContext > > *avctx, int block_no, > > bytestream2_skip(, ssize); > > continue; > > } > > -rate_x = 1 << bytestream2_get_byte(); > > +rate_x = bytestream2_get_byte(); > > +if (rate_x > 30) > > +return AVERROR_INVALIDDATA; > > +rate_x = 1 << rate_x; > > dsd_mode = bytestream2_get_byte(); > > if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) { > > av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: > > %d\n", > > @@ -1498,9 +1501,13 @@ static int wavpack_decode_block(AVCodecContext > > *avctx, int block_no, > > av_log(avctx, AV_LOG_ERROR, "Custom sample rate > > missing.\n"); > > return AVERROR_INVALIDDATA; > > } > > -new_samplerate = sample_rate * rate_x; > > +new_samplerate = sample_rate; > > } else > > -new_samplerate = wv_rates[sr] * rate_x; > > +new_samplerate = wv_rates[sr]; > > + > > +if (new_samplerate * (uint64_t)rate_x > INT_MAX) > > +return AVERROR_INVALIDDATA; > > +new_samplerate *= rate_x; > > > > if (multiblock) { > > if (chan) > > Looks correct to me. Thanks. will apply thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Freedom in capitalist society always remains about the same as it was in ancient Greek republics: Freedom for slave owners. -- Vladimir Lenin signature.asc Description: PGP signature ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 1/2] avcodec/wavpack: Check rate_x and sample rate for overflow
On 5/2/20 2:08 PM, Michael Niedermayer wrote: > Fixes: shift exponent 32 is too large for 32-bit type 'int' > Fixes: > 21647/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5686168323883008 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer > --- > libavcodec/wavpack.c | 13 ++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > index 58ab561a15..ead57063c8 100644 > --- a/libavcodec/wavpack.c > +++ b/libavcodec/wavpack.c > @@ -1359,7 +1359,10 @@ static int wavpack_decode_block(AVCodecContext *avctx, > int block_no, > bytestream2_skip(, ssize); > continue; > } > -rate_x = 1 << bytestream2_get_byte(); > +rate_x = bytestream2_get_byte(); > +if (rate_x > 30) > +return AVERROR_INVALIDDATA; > +rate_x = 1 << rate_x; > dsd_mode = bytestream2_get_byte(); > if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) { > av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: > %d\n", > @@ -1498,9 +1501,13 @@ static int wavpack_decode_block(AVCodecContext *avctx, > int block_no, > av_log(avctx, AV_LOG_ERROR, "Custom sample rate missing.\n"); > return AVERROR_INVALIDDATA; > } > -new_samplerate = sample_rate * rate_x; > +new_samplerate = sample_rate; > } else > -new_samplerate = wv_rates[sr] * rate_x; > +new_samplerate = wv_rates[sr]; > + > +if (new_samplerate * (uint64_t)rate_x > INT_MAX) > +return AVERROR_INVALIDDATA; > +new_samplerate *= rate_x; > > if (multiblock) { > if (chan) Looks correct to me. Thanks. ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 1/2] avcodec/wavpack: Check rate_x and sample rate for overflow
Fixes: shift exponent 32 is too large for 32-bit type 'int' Fixes: 21647/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5686168323883008 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/wavpack.c | 13 ++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index 58ab561a15..ead57063c8 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -1359,7 +1359,10 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, bytestream2_skip(, ssize); continue; } -rate_x = 1 << bytestream2_get_byte(); +rate_x = bytestream2_get_byte(); +if (rate_x > 30) +return AVERROR_INVALIDDATA; +rate_x = 1 << rate_x; dsd_mode = bytestream2_get_byte(); if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) { av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: %d\n", @@ -1498,9 +1501,13 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, av_log(avctx, AV_LOG_ERROR, "Custom sample rate missing.\n"); return AVERROR_INVALIDDATA; } -new_samplerate = sample_rate * rate_x; +new_samplerate = sample_rate; } else -new_samplerate = wv_rates[sr] * rate_x; +new_samplerate = wv_rates[sr]; + +if (new_samplerate * (uint64_t)rate_x > INT_MAX) +return AVERROR_INVALIDDATA; +new_samplerate *= rate_x; if (multiblock) { if (chan) -- 2.17.1 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".