July 2019 - ffmpeg-cvslog - lists.ffmpeg.org

tools/target_dec_fuzzer: fix memleak of extradata
by Michael Niedermayer 31 Jul '19

31 Jul '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Jul 10 22:32:49 2019 +0200| [42a2edcc1d772d9785f58d49ad29dd0846f923cd] | committer: Michael Niedermayer tools/target_dec_fuzzer: fix memleak of extradata Fixes: memleak Fixes: 15535/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5692162424963072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=42a2edcc1d772d978… --- tools/target_dec_fuzzer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 8ba25b4e8a..6ce90c9cbc 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -201,7 +201,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { int res = avcodec_open2(ctx, c, NULL); if (res < 0) { - av_free(ctx); + avcodec_free_context(&ctx); av_free(parser_avctx); av_parser_close(parser); return 0; // Failure of avcodec_open2() does not imply that a issue was found

1 0

avcodec/vc1_pred: Fix invalid shift in scaleforsame()
by Michael Niedermayer 31 Jul '19

31 Jul '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Jul 10 23:27:19 2019 +0200| [6dfda35dd29d2e2a86554d2c05d957a09ab79b0c] | committer: Michael Niedermayer avcodec/vc1_pred: Fix invalid shift in scaleforsame() Fixes: left shift of negative value -1 Fixes: 15531/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5759556258365440 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6dfda35dd29d2e2a8… --- libavcodec/vc1_pred.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/vc1_pred.c b/libavcodec/vc1_pred.c index 9e29b44a1f..16565063ea 100644 --- a/libavcodec/vc1_pred.c +++ b/libavcodec/vc1_pred.c @@ -178,7 +178,7 @@ static av_always_inline int scaleforsame(VC1Context *v, int i, int n /* MV */, brfd = FFMIN(v->brfd, 3); scalesame = ff_vc1_b_field_mvpred_scales[0][brfd]; - n = (n * scalesame >> 8) << hpel; + n = (n * scalesame >> 8) * (1 << hpel); return n; }

1 0

avcodec/vc1_block: Fix integer overflow in ff_vc1_pred_dc()
by Michael Niedermayer 31 Jul '19

31 Jul '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Jul 4 23:13:13 2019 +0200| [f31ed8f3b00ec7afe87092798bf0b397f6e19ed5] | committer: Michael Niedermayer avcodec/vc1_block: Fix integer overflow in ff_vc1_pred_dc() Fixes: signed integer overflow: 32796 * 65536 cannot be represented in type 'int' Fixes: 15430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5735424087031808 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f31ed8f3b00ec7afe… --- libavcodec/vc1_block.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/vc1_block.c b/libavcodec/vc1_block.c index ec5339d2f0..eda0b28964 100644 --- a/libavcodec/vc1_block.c +++ b/libavcodec/vc1_block.c @@ -430,12 +430,12 @@ static inline int ff_vc1_pred_dc(MpegEncContext *s, int overlap, int pq, int n, if (c_avail && (n != 1 && n != 3)) { q2 = FFABS(s->current_picture.qscale_table[mb_pos - 1]); if (q2 && q2 != q1) - c = (c * s->y_dc_scale_table[q2] * ff_vc1_dqscale[dqscale_index] + 0x20000) >> 18; + c = (int)((unsigned)c * s->y_dc_scale_table[q2] * ff_vc1_dqscale[dqscale_index] + 0x20000) >> 18; } if (a_avail && (n != 2 && n != 3)) { q2 = FFABS(s->current_picture.qscale_table[mb_pos - s->mb_stride]); if (q2 && q2 != q1) - a = (a * s->y_dc_scale_table[q2] * ff_vc1_dqscale[dqscale_index] + 0x20000) >> 18; + a = (int)((unsigned)a * s->y_dc_scale_table[q2] * ff_vc1_dqscale[dqscale_index] + 0x20000) >> 18; } if (a_avail && c_avail && (n != 3)) { int off = mb_pos; @@ -445,7 +445,7 @@ static inline int ff_vc1_pred_dc(MpegEncContext *s, int overlap, int pq, int n, off -= s->mb_stride; q2 = FFABS(s->current_picture.qscale_table[off]); if (q2 && q2 != q1) - b = (b * s->y_dc_scale_table[q2] * ff_vc1_dqscale[dqscale_index] + 0x20000) >> 18; + b = (int)((unsigned)b * s->y_dc_scale_table[q2] * ff_vc1_dqscale[dqscale_index] + 0x20000) >> 18; } if (c_avail && (!a_avail || abs(a - b) <= abs(b - c))) {

1 0

avcodec/truemotion2: Fix several integer overflows in tm2_motion_block()
by Michael Niedermayer 31 Jul '19

31 Jul '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Jul 8 23:00:09 2019 +0200| [9a353ea8766206bd302f3f12ca1d226237542908] | committer: Michael Niedermayer avcodec/truemotion2: Fix several integer overflows in tm2_motion_block() Fixes: 15524/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5173148372172800 Fixes: signed integer overflow: 13701388 - -2134868270 cannot be represented in type 'int' Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9a353ea8766206bd3… --- libavcodec/truemotion2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index a86dd16e0f..5d6dfc24c3 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -764,10 +764,10 @@ static inline void tm2_motion_block(TM2Context *ctx, AVFrame *pic, int bx, int b } /* calculate deltas */ Y -= Ystride * 4; - ctx->D[0] = Y[3] - last[3]; - ctx->D[1] = Y[3 + Ystride] - Y[3]; - ctx->D[2] = Y[3 + Ystride * 2] - Y[3 + Ystride]; - ctx->D[3] = Y[3 + Ystride * 3] - Y[3 + Ystride * 2]; + ctx->D[0] = (unsigned)Y[3] - last[3]; + ctx->D[1] = (unsigned)Y[3 + Ystride] - Y[3]; + ctx->D[2] = (unsigned)Y[3 + Ystride * 2] - Y[3 + Ystride]; + ctx->D[3] = (unsigned)Y[3 + Ystride * 3] - Y[3 + Ystride * 2]; for (i = 0; i < 4; i++) last[i] = Y[i + Ystride * 3]; }

1 0

avcodec/apedec: Make coeffsA/B uint32_t, this avoids several cases of undefined behavior
by Michael Niedermayer 31 Jul '19

31 Jul '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jul 2 12:30:32 2019 +0200| [1aad8937f73f9c8cc337e3173402f47175d077e7] | committer: Michael Niedermayer avcodec/apedec: Make coeffsA/B uint32_t, this avoids several cases of undefined behavior Changing the type to an unsigned one to avoid many casts was suggested This may be inadequate for fixing the UB on ILP64 Fixes: signed integer overflow: -1418162611 * 383 cannot be represented in type 'int' Fixes: 15547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5691384901664768 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1aad8937f73f9c8cc… --- libavcodec/apedec.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 7a7097e7a4..e9ffdfdcdf 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -125,8 +125,8 @@ typedef struct APEPredictor { int32_t filterA[2]; int32_t filterB[2]; - int32_t coeffsA[2][4]; ///< adaption coefficients - int32_t coeffsB[2][5]; ///< adaption coefficients + uint32_t coeffsA[2][4]; ///< adaption coefficients + uint32_t coeffsB[2][5]; ///< adaption coefficients int32_t historybuffer[HISTORY_SIZE + PREDICTOR_SIZE]; unsigned int sample_pos; @@ -829,7 +829,7 @@ static av_always_inline int filter_fast_3320(APEPredictor *p, } predictionA = p->buf[delayA] * 2 - p->buf[delayA - 1]; - p->lastA[filter] = decoded + (predictionA * p->coeffsA[filter][0] >> 9); + p->lastA[filter] = decoded + ((int32_t)(predictionA * p->coeffsA[filter][0]) >> 9); if ((decoded ^ predictionA) > 0) p->coeffsA[filter][0]++;

1 0

avcodec/apedec: make left/right unsigned to avoid undefined behavior
by Michael Niedermayer 31 Jul '19

31 Jul '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jul 2 12:13:19 2019 +0200| [bf778af1493b0814696307432763246fb53c75e7] | committer: Michael Niedermayer avcodec/apedec: make left/right unsigned to avoid undefined behavior Fixes: signed integer overflow: 755176387 + 1515360583 cannot be represented in type 'int' Fixes: 15506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5706859232624640 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bf778af1493b08146… --- libavcodec/apedec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 27425b17e6..7a7097e7a4 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -1376,7 +1376,7 @@ static void ape_unpack_mono(APEContext *ctx, int count) static void ape_unpack_stereo(APEContext *ctx, int count) { - int32_t left, right; + unsigned left, right; int32_t *decoded0 = ctx->decoded[0]; int32_t *decoded1 = ctx->decoded[1]; @@ -1393,7 +1393,7 @@ static void ape_unpack_stereo(APEContext *ctx, int count) /* Decorrelate and scale to output depth */ while (count--) { - left = *decoded1 - (*decoded0 / 2); + left = *decoded1 - (unsigned)(*decoded0 / 2); right = left + *decoded0; *(decoded0++) = left;

1 0

avcodec/apedec: Fix multiple integer overflows and undefined behaviorin filter_3800()
by Michael Niedermayer 31 Jul '19

31 Jul '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jun 16 11:39:15 2019 +0200| [267eb2ab7f87696e1a156ca9a5ff1b1628d170c1] | committer: Michael Niedermayer avcodec/apedec: Fix multiple integer overflows and undefined behaviorin filter_3800() Fixes: left shift of negative value -4 Fixes: signed integer overflow: -15091694 * 167 cannot be represented in type 'int' Fixes: signed integer overflow: 1898547155 + 453967445 cannot be represented in type 'int' Fixes: 15258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5759095564402688 Fixes: signed integer overflow: 962196438 * 31 cannot be represented in type 'int' Fixes: 15364/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718799845687296 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=267eb2ab7f87696e1… --- libavcodec/apedec.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 7cf99a00b1..27425b17e6 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -859,9 +859,9 @@ static av_always_inline int filter_3800(APEPredictor *p, return predictionA; } d2 = p->buf[delayA]; - d1 = (p->buf[delayA] - p->buf[delayA - 1]) << 1; - d0 = p->buf[delayA] + ((p->buf[delayA - 2] - p->buf[delayA - 1]) << 3); - d3 = p->buf[delayB] * 2 - p->buf[delayB - 1]; + d1 = (p->buf[delayA] - p->buf[delayA - 1]) * 2U; + d0 = p->buf[delayA] + ((p->buf[delayA - 2] - p->buf[delayA - 1]) * 8U); + d3 = p->buf[delayB] * 2U - p->buf[delayB - 1]; d4 = p->buf[delayB]; predictionA = d0 * p->coeffsA[filter][0] + @@ -881,7 +881,7 @@ static av_always_inline int filter_3800(APEPredictor *p, p->coeffsB[filter][1] -= (((d4 >> 30) & 2) - 1) * sign; p->filterB[filter] = p->lastA[filter] + (predictionB >> shift); - p->filterA[filter] = p->filterB[filter] + ((p->filterA[filter] * 31) >> 5); + p->filterA[filter] = p->filterB[filter] + ((int)(p->filterA[filter] * 31U) >> 5); return p->filterA[filter]; } @@ -902,7 +902,7 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len dotprod = 0; sign = APESIGN(buffer[i]); for (j = 0; j < order; j++) { - dotprod += delay[j] * coeffs[j]; + dotprod += delay[j] * (unsigned)coeffs[j]; coeffs[j] += ((delay[j] >> 31) | 1) * sign; } buffer[i] -= dotprod >> shift;

1 0

avformat/mpc: deallocate frames array on errors
by Michael Niedermayer 31 Jul '19

31 Jul '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Jul 24 23:11:50 2019 +0200| [da5039415c2bd625085d15e6c92e0b64eefddcbf] | committer: Michael Niedermayer avformat/mpc: deallocate frames array on errors Fixes: memleak on error path Fixes: 15984/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5679918412726272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=da5039415c2bd6250… --- libavformat/mpc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavformat/mpc.c b/libavformat/mpc.c index 487ff90c7d..a7b2e116ed 100644 --- a/libavformat/mpc.c +++ b/libavformat/mpc.c @@ -88,7 +88,7 @@ static int mpc_read_header(AVFormatContext *s) st = avformat_new_stream(s, NULL); if (!st) - return AVERROR(ENOMEM); + goto mem_error; st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_id = AV_CODEC_ID_MUSEPACK7; st->codecpar->channels = 2; @@ -96,7 +96,7 @@ static int mpc_read_header(AVFormatContext *s) st->codecpar->bits_per_coded_sample = 16; if (ff_get_extradata(s, st->codecpar, s->pb, 16) < 0) - return AVERROR(ENOMEM); + goto mem_error; st->codecpar->sample_rate = mpc_rate[st->codecpar->extradata[2] & 3]; avpriv_set_pts_info(st, 32, MPC_FRAMESIZE, st->codecpar->sample_rate); /* scan for seekpoints */ @@ -113,6 +113,9 @@ static int mpc_read_header(AVFormatContext *s) } return 0; +mem_error: + av_freep(&c->frames); + return AVERROR(ENOMEM); } static int mpc_read_packet(AVFormatContext *s, AVPacket *pkt)

1 0

lavfi/vf_thumbnail_cuda: fix operator precedence bug
by Rodger Combs 30 Jul '19

30 Jul '19

ffmpeg | branch: release/4.2 | Rodger Combs <rodger.combs(a)gmail.com> | Tue Jul 30 02:51:43 2019 -0500| [6a5ed71d36f700219f6f8cc69d767343f2fb8cb7] | committer: Timo Rothenpieler lavfi/vf_thumbnail_cuda: fix operator precedence bug Discovered via a warning when building with clang Signed-off-by: Timo Rothenpieler <timo(a)rothenpieler.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6a5ed71d36f700219… --- libavfilter/vf_thumbnail_cuda.cu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/vf_thumbnail_cuda.cu b/libavfilter/vf_thumbnail_cuda.cu index c73e49fbc6..d4d4d791f6 100644 --- a/libavfilter/vf_thumbnail_cuda.cu +++ b/libavfilter/vf_thumbnail_cuda.cu @@ -71,7 +71,7 @@ __global__ void Thumbnail_ushort2(cudaTextureObject_t ushort2_tex, { ushort2 pixel = tex2D<ushort2>(ushort2_tex, x, y); atomicAdd(&histogram[(pixel.x + 128) >> 8], 1); - atomicAdd(&histogram[256 + (pixel.y + 128) >> 8], 1); + atomicAdd(&histogram[256 + ((pixel.y + 128) >> 8)], 1); } }

1 0

lavfi/vf_thumbnail_cuda: fix operator precedence bug
by Rodger Combs 30 Jul '19

30 Jul '19

ffmpeg | branch: master | Rodger Combs <rodger.combs(a)gmail.com> | Tue Jul 30 02:51:43 2019 -0500| [a0c19707811cb5b4e6df089317dda65dd6a0240b] | committer: Timo Rothenpieler lavfi/vf_thumbnail_cuda: fix operator precedence bug Discovered via a warning when building with clang Signed-off-by: Timo Rothenpieler <timo(a)rothenpieler.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a0c19707811cb5b4e… --- libavfilter/vf_thumbnail_cuda.cu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/vf_thumbnail_cuda.cu b/libavfilter/vf_thumbnail_cuda.cu index c73e49fbc6..d4d4d791f6 100644 --- a/libavfilter/vf_thumbnail_cuda.cu +++ b/libavfilter/vf_thumbnail_cuda.cu @@ -71,7 +71,7 @@ __global__ void Thumbnail_ushort2(cudaTextureObject_t ushort2_tex, { ushort2 pixel = tex2D<ushort2>(ushort2_tex, x, y); atomicAdd(&histogram[(pixel.x + 128) >> 8], 1); - atomicAdd(&histogram[256 + (pixel.y + 128) >> 8], 1); + atomicAdd(&histogram[256 + ((pixel.y + 128) >> 8)], 1); } }

1 0