January 2021 - ffmpeg-cvslog - lists.ffmpeg.org

avformat/nutdec: Fix integer overflow in count computation
by Michael Niedermayer 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 16 22:44:33 2021 +0100| [0014249fd92132515b3ff0ce034dd65e745cb400] | committer: Michael Niedermayer avformat/nutdec: Fix integer overflow in count computation Note, the value is checked a few lines later already Fixes: signed integer overflow: -440402016 - 1879048064 cannot be represented in type 'int' Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6603876618469376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0014249fd92132515… --- libavformat/nutdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c index 53a052503e..88891721ca 100644 --- a/libavformat/nutdec.c +++ b/libavformat/nutdec.c @@ -260,7 +260,7 @@ static int decode_main_header(NUTContext *nut) if (tmp_fields > 5) count = ffio_read_varlen(bc); else - count = tmp_mul - tmp_size; + count = tmp_mul - (unsigned)tmp_size; if (tmp_fields > 6) get_s(bc); if (tmp_fields > 7)

1 0

avformat/mvi: Use 64bit for testing dimensions
by Michael Niedermayer 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 16 22:20:37 2021 +0100| [48fb752767086a48e599f9e86d87096f66cc7590] | committer: Michael Niedermayer avformat/mvi: Use 64bit for testing dimensions Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int' Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-6649291124899840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=48fb752767086a48e… --- libavformat/mvi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mvi.c b/libavformat/mvi.c index 06c9cfe3f0..2d4b11aa32 100644 --- a/libavformat/mvi.c +++ b/libavformat/mvi.c @@ -94,7 +94,7 @@ static int read_header(AVFormatContext *s) vst->codecpar->codec_type = AVMEDIA_TYPE_VIDEO; vst->codecpar->codec_id = AV_CODEC_ID_MOTIONPIXELS; - mvi->get_int = (vst->codecpar->width * vst->codecpar->height < (1 << 16)) ? avio_rl16 : avio_rl24; + mvi->get_int = (vst->codecpar->width * (int64_t)vst->codecpar->height < (1 << 16)) ? avio_rl16 : avio_rl24; mvi->audio_frame_size = ((uint64_t)mvi->audio_data_size << MVI_FRAC_BITS) / frames_count; if (mvi->audio_frame_size <= 1 << MVI_FRAC_BITS - 1) {

1 0

avformat/utils: Check dts in update_initial_timestamps() more
by Michael Niedermayer 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 16 22:05:53 2021 +0100| [29851cb840c176d514573914799ca6c95f3f4e8e] | committer: Michael Niedermayer avformat/utils: Check dts in update_initial_timestamps() more Fixes: signed integer overflow: -9223372036853488158 - 90000000 cannot be represented in type 'long long' Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MPSUB_fuzzer-6696625298866176 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=29851cb840c176d51… --- libavformat/utils.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/utils.c b/libavformat/utils.c index 6f100294a1..1ec71691e5 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -1106,6 +1106,7 @@ static void update_initial_timestamps(AVFormatContext *s, int stream_index, dts == AV_NOPTS_VALUE || st->cur_dts == AV_NOPTS_VALUE || st->cur_dts < INT_MIN + RELATIVE_TS_BASE || + dts < INT_MIN + (st->cur_dts - RELATIVE_TS_BASE) || is_relative(dts)) return;

1 0

avformat/mpsubdec: Use av_sat_add/sub64() in fracval handling
by Michael Niedermayer 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 16 21:48:57 2021 +0100| [463e024363d0ba0254c1f08b348bef02f148bb6a] | committer: Michael Niedermayer avformat/mpsubdec: Use av_sat_add/sub64() in fracval handling Fixes: signed integer overflow: 9223372036850000000 + 9000000 cannot be represented in type 'long long' Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MPSUB_fuzzer-665448017480908 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=463e024363d0ba025… --- libavformat/mpsubdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/mpsubdec.c b/libavformat/mpsubdec.c index e7b83a1d85..2e6dc883eb 100644 --- a/libavformat/mpsubdec.c +++ b/libavformat/mpsubdec.c @@ -72,8 +72,8 @@ static int parse_line(const char *line, int64_t *value, int64_t *value2) fracval *= 10; for (;p2 - p1 > 7 + 1; p1++) fracval /= 10; - if (intval > 0) intval += fracval; - else intval -= fracval; + if (intval > 0) intval = av_sat_add64(intval, fracval); + else intval = av_sat_sub64(intval, fracval); line += p2; } else line += p1;

1 0

avformat/flvdec: Check for avio_read() failure in amf_get_string()
by Michael Niedermayer 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jan 26 17:41:28 2021 +0100| [cb316676112c01e8d66420908b6b3d06b3b498e3] | committer: Michael Niedermayer avformat/flvdec: Check for avio_read() failure in amf_get_string() Suggested-by: Anton Khirnov <anton(a)khirnov.net> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cb316676112c01e8d… --- libavformat/flvdec.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 8571a626ae..c1f02125bc 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -384,13 +384,18 @@ static int flv_set_video_codec(AVFormatContext *s, AVStream *vstream, static int amf_get_string(AVIOContext *ioc, char *buffer, int buffsize) { + int ret; int length = avio_rb16(ioc); if (length >= buffsize) { avio_skip(ioc, length); return -1; } - avio_read(ioc, buffer, length); + ret = avio_read(ioc, buffer, length); + if (ret < 0) + return ret; + if (ret < length) + return AVERROR_INVALIDDATA; buffer[length] = '\0';

1 0

avformat/flvdec: Check for nesting depth in amf_skip_tag()
by Michael Niedermayer 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 23 22:00:40 2021 +0100| [2ef522c918d48b9f101548b2cadce02003cb3510] | committer: Michael Niedermayer avformat/flvdec: Check for nesting depth in amf_skip_tag() Fixes: out of array access Fixes: 29440/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5985279812960256.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2ef522c918d48b9f1… --- libavformat/flvdec.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 5e4af8eca4..8571a626ae 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -842,10 +842,13 @@ static void clear_index_entries(AVFormatContext *s, int64_t pos) } } -static int amf_skip_tag(AVIOContext *pb, AMFDataType type) +static int amf_skip_tag(AVIOContext *pb, AMFDataType type, int depth) { int nb = -1, ret, parse_name = 1; + if (depth > MAX_DEPTH) + return AVERROR_PATCHWELCOME; + switch (type) { case AMF_DATA_TYPE_NUMBER: avio_skip(pb, 8); @@ -870,7 +873,7 @@ static int amf_skip_tag(AVIOContext *pb, AMFDataType type) } avio_skip(pb, size); } - if ((ret = amf_skip_tag(pb, avio_r8(pb))) < 0) + if ((ret = amf_skip_tag(pb, avio_r8(pb), depth + 1)) < 0) return ret; } break; @@ -914,7 +917,7 @@ static int flv_data_packet(AVFormatContext *s, AVPacket *pkt, else break; } else { - if ((ret = amf_skip_tag(pb, type)) < 0) + if ((ret = amf_skip_tag(pb, type, 0)) < 0) goto skip; } }

1 0

avformat/flvdec: Check for nesting depth in amf_parse_object()
by Michael Niedermayer 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 23 21:20:57 2021 +0100| [074e204b42acdacc0a055671481e00914524af93] | committer: Michael Niedermayer avformat/flvdec: Check for nesting depth in amf_parse_object() Fixes: out of array access Fixes: 29202/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5112845840809984 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=074e204b42acdacc0… --- libavformat/flvdec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 07ef342278..5e4af8eca4 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -41,6 +41,8 @@ #define RESYNC_BUFFER_SIZE (1<<20) +#define MAX_DEPTH 16 ///< arbitrary limit to prevent unbounded recursion + typedef struct FLVContext { const AVClass *class; ///< Class for private options. int trust_metadata; ///< configure streams according onMetaData @@ -493,6 +495,9 @@ static int amf_parse_object(AVFormatContext *s, AVStream *astream, double num_val; amf_date date; + if (depth > MAX_DEPTH) + return AVERROR_PATCHWELCOME; + num_val = 0; ioc = s->pb; if (avio_feof(ioc))

1 0

avcodec/apedec: Use FFABSU() in do_apply_filter()
by Michael Niedermayer 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Jan 21 00:07:46 2021 +0100| [59a6becf8ecb1ea25faaeaaf45f4d28de39606eb] | committer: Michael Niedermayer avcodec/apedec: Use FFABSU() in do_apply_filter() Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself Fixes: 29053/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4814432697974784 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Anton Khirnov <anton(a)khirnov.net> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=59a6becf8ecb1ea25… --- libavcodec/apedec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 8fe7b5ee86..388d851d03 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -1333,7 +1333,7 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f, /* Version 3.98 and later files */ /* Update the adaption coefficients */ - absres = FFABS(res); + absres = FFABSU(res); if (absres) *f->adaptcoeffs = APESIGN(res) * (8 << ((absres > f->avg * 3) + (absres > f->avg * 4 / 3)));

1 0

avutil/common: Add FFABSU() for a signed -> unsigned ABS
by Michael Niedermayer 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 23 16:22:33 2021 +0100| [5dd95670808915b391348624d3f9860e021a81a2] | committer: Michael Niedermayer avutil/common: Add FFABSU() for a signed -> unsigned ABS Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5dd95670808915b39… --- doc/APIchanges | 3 +++ libavutil/common.h | 8 ++++++++ libavutil/version.h | 4 ++-- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/doc/APIchanges b/doc/APIchanges index 1509c9b8cb..1332694820 100644 --- a/doc/APIchanges +++ b/doc/APIchanges @@ -15,6 +15,9 @@ libavutil: 2017-10-21 API changes, most recent first: +2021-01-26 - xxxxxxxxxx - lavu 56.64.100 - common.h + Add FFABSU() + 2021-01-25 - xxxxxxxxxx - lavc 58.119.100 - avcodec.h Deprecate AVCodecContext.debug_mv, FF_DEBUG_VIS_MV_P_FOR, FF_DEBUG_VIS_MV_B_FOR, FF_DEBUG_VIS_MV_B_BACK diff --git a/libavutil/common.h b/libavutil/common.h index b9fbcc4d60..a60a558b1d 100644 --- a/libavutil/common.h +++ b/libavutil/common.h @@ -80,6 +80,14 @@ */ #define FFNABS(a) ((a) <= 0 ? (a) : (-(a))) +/** + * Unsigned Absolute value. + * This takes the absolute value of a signed int and returns it as a unsigned. + * This also works with INT_MIN which would otherwise not be representable + * As with many macros, this evaluates its argument twice. + */ +#define FFABSU(a) ((a) <= 0 ? -(unsigned)(a) : (unsigned)(a)) + /** * Comparator. * For two numerical expressions x and y, gives 1 if x > y, -1 if x < y, and 0 diff --git a/libavutil/version.h b/libavutil/version.h index bb8d60bef5..21136e6cb7 100644 --- a/libavutil/version.h +++ b/libavutil/version.h @@ -79,8 +79,8 @@ */ #define LIBAVUTIL_VERSION_MAJOR 56 -#define LIBAVUTIL_VERSION_MINOR 63 -#define LIBAVUTIL_VERSION_MICRO 101 +#define LIBAVUTIL_VERSION_MINOR 64 +#define LIBAVUTIL_VERSION_MICRO 100 #define LIBAVUTIL_VERSION_INT AV_VERSION_INT(LIBAVUTIL_VERSION_MAJOR, \ LIBAVUTIL_VERSION_MINOR, \

1 0

avfilter/vf_unsharp: Remove unnecessary ;
by Andreas Rheinhardt 26 Jan '21

26 Jan '21

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)gmail.com> | Sun Jan 24 22:26:06 2021 +0100| [3c700c82cbee49d1f40b6a7063f4b084ae3ee747] | committer: Andreas Rheinhardt avfilter/vf_unsharp: Remove unnecessary ; A macro that expands to a function definition might look like a declaration, but it isn't and therefore an extra ';' at the end is unnecessary and actually invalid (both GCC and Clang warn about this when using -pedantic). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3c700c82cbee49d1f… --- libavfilter/vf_unsharp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_unsharp.c b/libavfilter/vf_unsharp.c index e9b6c9008d..198dbbaa51 100644 --- a/libavfilter/vf_unsharp.c +++ b/libavfilter/vf_unsharp.c @@ -139,8 +139,8 @@ static int name##_##nbits(AVFilterContext *ctx, void *arg, int jobnr, int nb_job } \ return 0; \ } -DEF_UNSHARP_SLICE_FUNC(unsharp_slice, 16); -DEF_UNSHARP_SLICE_FUNC(unsharp_slice, 8); +DEF_UNSHARP_SLICE_FUNC(unsharp_slice, 16) +DEF_UNSHARP_SLICE_FUNC(unsharp_slice, 8) static int apply_unsharp_c(AVFilterContext *ctx, AVFrame *in, AVFrame *out) {

1 0