June 2019 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight
by Michael Niedermayer 30 Jun '19

30 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jun 25 10:29:57 2019 +0200| [3b2082c663dac93fd722289a540c1b1e24a12564] | committer: Michael Niedermayer avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight Suggested-by: James Almer <jamrial(a)gmail.com> Reviewed-by: James Almer <jamrial(a)gmail.com Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3b2082c663dac93fd… --- libavcodec/hevc_ps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 07d220a5c8..f6e80e1609 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -1588,14 +1588,14 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, int num_tile_rows_minus1 = get_ue_golomb(gb); if (num_tile_columns_minus1 < 0 || - num_tile_columns_minus1 >= sps->width - 1) { + num_tile_columns_minus1 >= sps->ctb_width - 1) { av_log(avctx, AV_LOG_ERROR, "num_tile_columns_minus1 out of range: %d\n", num_tile_columns_minus1); ret = num_tile_columns_minus1 < 0 ? num_tile_columns_minus1 : AVERROR_INVALIDDATA; goto err; } if (num_tile_rows_minus1 < 0 || - num_tile_rows_minus1 >= sps->height - 1) { + num_tile_rows_minus1 >= sps->ctb_height - 1) { av_log(avctx, AV_LOG_ERROR, "num_tile_rows_minus1 out of range: %d\n", num_tile_rows_minus1); ret = num_tile_rows_minus1 < 0 ? num_tile_rows_minus1 : AVERROR_INVALIDDATA;

1 0

avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns
by Michael Niedermayer 30 Jun '19

30 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Jun 13 15:05:54 2019 +0200| [c692051252693155c4eecd16f4f8a79caf66cd54] | committer: Michael Niedermayer avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' Fixes: 14880/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5130977304641536 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c692051252693155c… --- libavcodec/hevc_ps.c | 23 +++++++++++++---------- libavcodec/hevc_ps.h | 4 ++-- 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 80df417e4f..07d220a5c8 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -1584,22 +1584,25 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, pps->entropy_coding_sync_enabled_flag = get_bits1(gb); if (pps->tiles_enabled_flag) { - pps->num_tile_columns = get_ue_golomb_long(gb) + 1; - pps->num_tile_rows = get_ue_golomb_long(gb) + 1; - if (pps->num_tile_columns <= 0 || - pps->num_tile_columns >= sps->width) { + int num_tile_columns_minus1 = get_ue_golomb(gb); + int num_tile_rows_minus1 = get_ue_golomb(gb); + + if (num_tile_columns_minus1 < 0 || + num_tile_columns_minus1 >= sps->width - 1) { av_log(avctx, AV_LOG_ERROR, "num_tile_columns_minus1 out of range: %d\n", - pps->num_tile_columns - 1); - ret = AVERROR_INVALIDDATA; + num_tile_columns_minus1); + ret = num_tile_columns_minus1 < 0 ? num_tile_columns_minus1 : AVERROR_INVALIDDATA; goto err; } - if (pps->num_tile_rows <= 0 || - pps->num_tile_rows >= sps->height) { + if (num_tile_rows_minus1 < 0 || + num_tile_rows_minus1 >= sps->height - 1) { av_log(avctx, AV_LOG_ERROR, "num_tile_rows_minus1 out of range: %d\n", - pps->num_tile_rows - 1); - ret = AVERROR_INVALIDDATA; + num_tile_rows_minus1); + ret = num_tile_rows_minus1 < 0 ? num_tile_rows_minus1 : AVERROR_INVALIDDATA; goto err; } + pps->num_tile_columns = num_tile_columns_minus1 + 1; + pps->num_tile_rows = num_tile_rows_minus1 + 1; pps->column_width = av_malloc_array(pps->num_tile_columns, sizeof(*pps->column_width)); pps->row_height = av_malloc_array(pps->num_tile_rows, sizeof(*pps->row_height)); diff --git a/libavcodec/hevc_ps.h b/libavcodec/hevc_ps.h index bbaa9205ef..2840dc416f 100644 --- a/libavcodec/hevc_ps.h +++ b/libavcodec/hevc_ps.h @@ -347,8 +347,8 @@ typedef struct HEVCPPS { uint8_t tiles_enabled_flag; uint8_t entropy_coding_sync_enabled_flag; - int num_tile_columns; ///< num_tile_columns_minus1 + 1 - int num_tile_rows; ///< num_tile_rows_minus1 + 1 + uint16_t num_tile_columns; ///< num_tile_columns_minus1 + 1 + uint16_t num_tile_rows; ///< num_tile_rows_minus1 + 1 uint8_t uniform_spacing_flag; uint8_t loop_filter_across_tiles_enabled_flag;

1 0

avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
by Michael Niedermayer 30 Jun '19

30 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jun 16 11:26:57 2019 +0200| [3d4f4f4a15e79c96c3613e5c252b2f5cc4190e18] | committer: Michael Niedermayer avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264 Fixes: left shift of 1 by 31 places cannot be represented in type 'int' Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3d4f4f4a15e79c96c… --- libavcodec/apedec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 15eb416ba4..eb31fd70c1 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -460,7 +460,7 @@ static inline void update_rice(APERice *rice, unsigned int x) if (rice->ksum < lim) rice->k--; - else if (rice->ksum >= (1 << (rice->k + 5))) + else if (rice->ksum >= (1 << (rice->k + 5)) && rice->k < 24) rice->k++; }

1 0

avformat/aviobuf: Delay buffer downsizing until asserts are met
by Michael Niedermayer 30 Jun '19

30 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jun 9 22:04:16 2019 +0200| [0334632d5c02720f1829d59cd20c009584b5b163] | committer: Michael Niedermayer avformat/aviobuf: Delay buffer downsizing until asserts are met Fixes: Assertion failure Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616 Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432 May fix: Ticket7094 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0334632d5c02720f1… --- libavformat/aviobuf.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 5a33f82950..6a5cd97b0a 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -570,7 +570,7 @@ static void fill_buffer(AVIOContext *s) } /* make buffer smaller in case it ended up large after probing */ - if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size) { + if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size && len >= s->orig_buffer_size) { if (dst == s->buffer && s->buf_ptr != dst) { int ret = ffio_set_buf_size(s, s->orig_buffer_size); if (ret < 0) @@ -578,7 +578,6 @@ static void fill_buffer(AVIOContext *s) s->checksum_ptr = dst = s->buffer; } - av_assert0(len >= s->orig_buffer_size); len = s->orig_buffer_size; }

1 0

avcodec/fitsdec: Check data_min/max
by Michael Niedermayer 30 Jun '19

30 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Jun 13 00:24:53 2019 +0200| [eb82d19f035f59edf0aee215f02baaea908875de] | committer: Michael Niedermayer avcodec/fitsdec: Check data_min/max Fixes: division by 0 Fixes: 15206/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5657260212092928 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=eb82d19f035f59edf… --- libavcodec/fitsdec.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/fitsdec.c b/libavcodec/fitsdec.c index 67a8bd71f4..4f452422ef 100644 --- a/libavcodec/fitsdec.c +++ b/libavcodec/fitsdec.c @@ -168,6 +168,14 @@ static int fits_read_header(AVCodecContext *avctx, const uint8_t **ptr, FITSHead header->data_min = (header->data_min - header->bzero) / header->bscale; header->data_max = (header->data_max - header->bzero) / header->bscale; } + if (!header->rgb && header->data_min >= header->data_max) { + if (header->data_min > header->data_max) { + av_log(avctx, AV_LOG_ERROR, "data min/max (%g %g) is invalid\n", header->data_min, header->data_max); + return AVERROR_INVALIDDATA; + } + av_log(avctx, AV_LOG_WARNING, "data min/max indicates a blank image\n"); + header->data_max ++; + } return 0; }

1 0

avcodec/m101: Fix off be 2 error
by Michael Niedermayer 29 Jun '19

29 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Jun 17 21:13:17 2019 +0200| [89b96900fa7c17d0770c9af26af7c3ae36ae0253] | committer: Michael Niedermayer avcodec/m101: Fix off be 2 error Fixes: out of array read Fixes: 15263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_M101_fuzzer-5728999453491200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=89b96900fa7c17d07… --- libavcodec/m101.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/m101.c b/libavcodec/m101.c index d2549668fd..70f1da4f45 100644 --- a/libavcodec/m101.c +++ b/libavcodec/m101.c @@ -61,7 +61,7 @@ static int m101_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, stride = AV_RL32(avctx->extradata + 5*4); if (avctx->pix_fmt == AV_PIX_FMT_YUV422P10) - min_stride = (avctx->width + 15) / 16 * 20; + min_stride = (avctx->width + 15) / 16 * 40; if (stride < min_stride || avpkt->size < stride * (uint64_t)avctx->height) { av_log(avctx, AV_LOG_ERROR, "stride (%d) is invalid for packet sized %d\n",

1 0

avcodec/qdm2: Move fft_order check up
by Michael Niedermayer 29 Jun '19

29 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Jun 17 20:58:47 2019 +0200| [8d8b8c4ac6fb5b5d40bd131f2d2ea9d85b8759a6] | committer: Michael Niedermayer avcodec/qdm2: Move fft_order check up This avoids undefined computations with unchecked values Fixes: shift exponent -21 is negative Fixes: 15262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5651261753393152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8d8b8c4ac6fb5b5d4… --- libavcodec/qdm2.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c index 88b6b19d11..1397218bdd 100644 --- a/libavcodec/qdm2.c +++ b/libavcodec/qdm2.c @@ -1702,6 +1702,12 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx) s->fft_order = av_log2(s->fft_size) + 1; + // Fail on unknown fft order + if ((s->fft_order < 7) || (s->fft_order > 9)) { + avpriv_request_sample(avctx, "Unknown FFT order %d", s->fft_order); + return AVERROR_PATCHWELCOME; + } + // something like max decodable tones s->group_order = av_log2(s->group_size) + 1; s->frame_size = s->group_size / 16; // 16 iterations per super block @@ -1735,11 +1741,6 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx) else s->coeff_per_sb_select = 2; - // Fail on unknown fft order - if ((s->fft_order < 7) || (s->fft_order > 9)) { - avpriv_request_sample(avctx, "Unknown FFT order %d", s->fft_order); - return AVERROR_PATCHWELCOME; - } if (s->fft_size != (1 << (s->fft_order - 1))) { av_log(avctx, AV_LOG_ERROR, "FFT size %d not power of 2.\n", s->fft_size); return AVERROR_INVALIDDATA;

1 0

avcodec/libvorbisdec: Check extradata size
by Michael Niedermayer 29 Jun '19

29 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Jun 17 21:26:45 2019 +0200| [cf3c245566e8a8d45ed2ad9fdff9ef50327ba2d3] | committer: Michael Niedermayer avcodec/libvorbisdec: Check extradata size Fixes: out of array read Fixes: 15261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5764908467093504 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cf3c245566e8a8d45… --- libavcodec/libvorbisdec.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/libvorbisdec.c b/libavcodec/libvorbisdec.c index ecf690a553..89cbbb41b6 100644 --- a/libavcodec/libvorbisdec.c +++ b/libavcodec/libvorbisdec.c @@ -49,8 +49,16 @@ static int oggvorbis_decode_init(AVCodecContext *avccontext) { vorbis_comment_init(&context->vc) ; if(p[0] == 0 && p[1] == 30) { + int sizesum = 0; for(i = 0; i < 3; i++){ hsizes[i] = bytestream_get_be16((const uint8_t **)&p); + sizesum += 2 + hsizes[i]; + if (sizesum > avccontext->extradata_size) { + av_log(avccontext, AV_LOG_ERROR, "vorbis extradata too small\n"); + ret = AVERROR_INVALIDDATA; + goto error; + } + headers[i] = p; p += hsizes[i]; }

1 0

avformat/vqf: Check header_size
by Michael Niedermayer 29 Jun '19

29 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jun 18 23:17:23 2019 +0200| [7c30ff38880570377168096417f714b21102b343] | committer: Michael Niedermayer avformat/vqf: Check header_size Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808 Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int' Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7c30ff38880570377… --- libavformat/vqf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/vqf.c b/libavformat/vqf.c index a58992318a..755849bac7 100644 --- a/libavformat/vqf.c +++ b/libavformat/vqf.c @@ -107,6 +107,9 @@ static int vqf_read_header(AVFormatContext *s) header_size = avio_rb32(s->pb); + if (header_size < 0) + return AVERROR_INVALIDDATA; + st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_id = AV_CODEC_ID_TWINVQ; st->start_time = 0; @@ -120,7 +123,7 @@ static int vqf_read_header(AVFormatContext *s) len = avio_rb32(s->pb); - if ((unsigned) len > INT_MAX/2) { + if ((unsigned) len > INT_MAX/2 || header_size < 8) { av_log(s, AV_LOG_ERROR, "Malformed header\n"); return -1; }

1 0

avcodec/atrac9dec: Check q_unit_cnt in parse_band_ext()
by Michael Niedermayer 29 Jun '19

29 Jun '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jun 16 21:01:50 2019 +0200| [fb4a4557d15bce601e2462207648741600fa273f] | committer: Michael Niedermayer avcodec/atrac9dec: Check q_unit_cnt in parse_band_ext() Fixes: global-buffer-overflow Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fb4a4557d15bce601… --- libavcodec/atrac9dec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/atrac9dec.c b/libavcodec/atrac9dec.c index 08fe483e39..4d490daeb0 100644 --- a/libavcodec/atrac9dec.c +++ b/libavcodec/atrac9dec.c @@ -202,6 +202,8 @@ static inline int parse_band_ext(ATRAC9Context *s, ATRAC9BlockData *b, int ext_band = 0; if (b->has_band_ext) { + if (b->q_unit_cnt < 13) + return AVERROR_INVALIDDATA; ext_band = at9_tab_band_ext_group[b->q_unit_cnt - 13][2]; if (stereo) { b->channel[1].band_ext = get_bits(gb, 2);

1 0