April 2023 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec/hevc_ps: check for out of range bitdepth in SPS
by James Almer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Sun Apr 30 20:38:55 2023 -0300| [e7c690a04692ac113e362ef81dd3cff8715c9ed2] | committer: James Almer avcodec/hevc_ps: check for out of range bitdepth in SPS Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e7c690a04692ac113… --- libavcodec/hevc_ps.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 5b84e53ced..a55bced0f7 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -927,8 +927,18 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id, sps->output_window = sps->pic_conf_win; } - sps->bit_depth = get_ue_golomb_long(gb) + 8; - bit_depth_chroma = get_ue_golomb_long(gb) + 8; + sps->bit_depth = get_ue_golomb_31(gb) + 8; + if (sps->bit_depth > 16) { + av_log(avctx, AV_LOG_ERROR, "Luma bit depth (%d) is out of range\n", + sps->bit_depth); + return AVERROR_INVALIDDATA; + } + bit_depth_chroma = get_ue_golomb_31(gb) + 8; + if (bit_depth_chroma > 16) { + av_log(avctx, AV_LOG_ERROR, "Chroma bit depth (%d) is out of range\n", + bit_depth_chroma); + return AVERROR_INVALIDDATA; + } if (sps->chroma_format_idc && bit_depth_chroma != sps->bit_depth) { av_log(avctx, AV_LOG_ERROR, "Luma bit depth (%d) is different from chroma bit depth (%d), "

1 0

avcodec/hevc_ps: Avoid signed overflow before check on QP
by Michael Niedermayer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Apr 25 22:50:55 2023 +0200| [bf3f91c425b430b31e373e9eb5ffdaf1422132af] | committer: Michael Niedermayer avcodec/hevc_ps: Avoid signed overflow before check on QP Fixes: signed integer overflow: -2147483648 - 5 cannot be represented in type 'int' Fixes: 58066/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5312995835379712 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bf3f91c425b430b31… --- libavcodec/hevc_ps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 266adb6e86..5b84e53ced 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -1529,9 +1529,9 @@ static int pps_scc_extension(GetBitContext *gb, AVCodecContext *avctx, pps->pps_curr_pic_ref_enabled_flag = get_bits1(gb); if (pps->residual_adaptive_colour_transform_enabled_flag = get_bits1(gb)) { pps->pps_slice_act_qp_offsets_present_flag = get_bits1(gb); - pps->pps_act_y_qp_offset = get_se_golomb_long(gb) - 5; - pps->pps_act_cb_qp_offset = get_se_golomb_long(gb) - 5; - pps->pps_act_cr_qp_offset = get_se_golomb_long(gb) - 3; + pps->pps_act_y_qp_offset = get_se_golomb(gb) - 5; + pps->pps_act_cb_qp_offset = get_se_golomb(gb) - 5; + pps->pps_act_cr_qp_offset = get_se_golomb(gb) - 3; #define CHECK_QP_OFFSET(name) (pps->pps_act_ ## name ## _qp_offset <= -12 || \ pps->pps_act_ ## name ## _qp_offset >= 12)

1 0

tools/target_dec_fuzzer: Adjust threshold for rka
by Michael Niedermayer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Apr 25 21:50:10 2023 +0200| [69eb8197af1e1fbfbf54653da039720c061d54f6] | committer: Michael Niedermayer tools/target_dec_fuzzer: Adjust threshold for rka Fixes: Timeout Fixes: 57993/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RKA_fuzzer-5825782785376256 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=69eb8197af1e1fbfb… --- tools/target_dec_fuzzer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 87a9f6eb17..d8e93f3a21 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -271,6 +271,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { case AV_CODEC_ID_QTRLE: maxpixels /= 16; break; case AV_CODEC_ID_PAF_VIDEO: maxpixels /= 16; break; case AV_CODEC_ID_PRORES: maxpixels /= 256; break; + case AV_CODEC_ID_RKA: maxsamples /= 256; break; case AV_CODEC_ID_RSCC: maxpixels /= 256; break; case AV_CODEC_ID_RASC: maxpixels /= 16; break; case AV_CODEC_ID_SANM: maxpixels /= 16; break;

1 0

avcodec/hevc_ps: Check depth to be within 8 to 16
by Michael Niedermayer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Apr 16 23:55:56 2023 +0200| [cb8180aa66839fe05e3a29504fb2f67336312227] | committer: Michael Niedermayer avcodec/hevc_ps: Check depth to be within 8 to 16 Fixes: assertion failure in bitreader Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-627318668066816 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cb8180aa66839fe05… --- libavcodec/hevc_ps.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index bba0ebd1dd..266adb6e86 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -1557,6 +1557,10 @@ static int pps_scc_extension(GetBitContext *gb, AVCodecContext *avctx, pps->luma_bit_depth_entry = get_ue_golomb_31(gb) + 8; if (!pps->monochrome_palette_flag) pps->chroma_bit_depth_entry = get_ue_golomb_31(gb) + 8; + + if (pps->chroma_bit_depth_entry > 16 || pps->chroma_bit_depth_entry > 16) + return AVERROR_INVALIDDATA; + num_comps = pps->monochrome_palette_flag ? 1 : 3; for (int comp = 0; comp < num_comps; comp++) { int bit_depth = !comp ? pps->luma_bit_depth_entry : pps->chroma_bit_depth_entry;

1 0

avcodec/wavarc: Check order before using it to write the list
by Michael Niedermayer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Apr 16 17:51:02 2023 +0200| [e2e34c7731372b65b41ddb11334ccaeba4a76f13] | committer: Michael Niedermayer avcodec/wavarc: Check order before using it to write the list Fixes: out of array access Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-6247711015043072 Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-6487578428964864 Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-6651587794960384 Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-6686265824378880 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e2e34c7731372b65b… --- libavcodec/wavarc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c index 896972cec8..827803c91d 100644 --- a/libavcodec/wavarc.c +++ b/libavcodec/wavarc.c @@ -343,6 +343,8 @@ static int decode_2slp(AVCodecContext *avctx, break; case 0: order = get_urice(gb, 2); + if ((unsigned)order >= FF_ARRAY_ELEMS(s->filter[ch])) + return AVERROR_INVALIDDATA; for (int o = 0; o < order; o++) s->filter[ch][o] = get_srice(gb, 2); for (int n = 0; n < s->nb_samples; n++) {

1 0

avcodec/bonk: decode multiple passes in intlist_read() at once
by Michael Niedermayer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Nov 5 19:33:33 2022 +0100| [957106a24d2960e1d0359a1774b547c1292b4704] | committer: Michael Niedermayer avcodec/bonk: decode multiple passes in intlist_read() at once This makes the worst case much faster Fixes: Timeout Fixes: 51363/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5660734784143360 Fixes: 57957/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5874095467397120 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=957106a24d2960e1d… --- libavcodec/bonk.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c index 5f510e4910..4a00270392 100644 --- a/libavcodec/bonk.c +++ b/libavcodec/bonk.c @@ -155,6 +155,7 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part) int n_zeros = 0, step = 256, dominant = 0; int pos = 0, level = 0; BitCount *bits = s->bits; + int passes = 1; memset(buf, 0, entries * sizeof(*buf)); if (base_2_part) { @@ -216,24 +217,28 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part) x = 0; n_zeros = 0; for (i = 0; n_zeros < entries; i++) { + if (x >= max_x) + return AVERROR_INVALIDDATA; + if (pos >= entries) { pos = 0; - level += 1 << low_bits; + level += passes << low_bits; + passes = 1; + if (bits[x].bit && bits[x].count > entries - n_zeros) + passes = bits[x].count / (entries - n_zeros); } if (level > 1 << 16) return AVERROR_INVALIDDATA; - if (x >= max_x) - return AVERROR_INVALIDDATA; - if (buf[pos] >= level) { if (bits[x].bit) - buf[pos] += 1 << low_bits; + buf[pos] += passes << low_bits; else n_zeros++; - bits[x].count--; + av_assert1(bits[x].count >= passes); + bits[x].count -= passes; x += bits[x].count == 0; }

1 0

avcodec/cavsdec: Check bits left before picture allocation
by Michael Niedermayer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Apr 24 00:15:04 2023 +0200| [e734e165442b4bf1598b167c373928d993371f0d] | committer: Michael Niedermayer avcodec/cavsdec: Check bits left before picture allocation Fixes: Timeout Fixes: 57893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5091726540013568 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e734e165442b4bf15… --- libavcodec/cavsdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index b1fa9a981d..37071dfbc7 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -1020,6 +1020,9 @@ static int decode_pic(AVSContext *h) skip_bits(&h->gb, 1); //marker_bit } + if (get_bits_left(&h->gb) < 23) + return AVERROR_INVALIDDATA; + ret = ff_get_buffer(h->avctx, h->cur.f, h->cur.f->pict_type == AV_PICTURE_TYPE_B ? 0 : AV_GET_BUFFER_FLAG_REF); if (ret < 0)

1 0

tools/target_dec_fuzzer: Adjust threshold for APE
by Michael Niedermayer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Apr 24 00:06:54 2023 +0200| [f6dffe6fc4d872b371e330447e77576ffc939220] | committer: Michael Niedermayer tools/target_dec_fuzzer: Adjust threshold for APE Fixes: Timeout Fixes: 57889/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5262308950802432 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f6dffe6fc4d872b37… --- tools/target_dec_fuzzer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index f059ddb4c7..87a9f6eb17 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -211,6 +211,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { case AV_CODEC_ID_AASC: maxpixels /= 1024; break; case AV_CODEC_ID_AGM: maxpixels /= 1024; break; case AV_CODEC_ID_ANM: maxpixels /= 1024; break; + case AV_CODEC_ID_APE: maxsamples /= 16384; break; case AV_CODEC_ID_ARBC: maxpixels /= 1024; break; case AV_CODEC_ID_ARGO: maxpixels /= 1024; break; case AV_CODEC_ID_BETHSOFTVID: maxpixels /= 8192; break;

1 0

avcodec/apedec: Factor constant sign out of loop in long_filter_high_3800()
by Michael Niedermayer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Apr 23 23:54:50 2023 +0200| [b2a3279dbe1f1c6a2b9c36a6137281c828b5d0e4] | committer: Michael Niedermayer avcodec/apedec: Factor constant sign out of loop in long_filter_high_3800() 930 -> 850 cycles Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b2a3279dbe1f1c6a2… --- libavcodec/apedec.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 40cd78a991..772636afde 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -955,9 +955,20 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len for (i = order; i < length; i++) { dotprod = 0; sign = APESIGN(buffer[i]); - for (j = 0; j < order; j++) { - dotprod += delayp[j] * (unsigned)coeffs[j]; - coeffs[j] += ((delayp[j] >> 31) | 1) * sign; + if (sign == 1) { + for (j = 0; j < order; j++) { + dotprod += delayp[j] * (unsigned)coeffs[j]; + coeffs[j] += (delayp[j] >> 31) | 1; + } + } else if (sign == -1) { + for (j = 0; j < order; j++) { + dotprod += delayp[j] * (unsigned)coeffs[j]; + coeffs[j] -= (delayp[j] >> 31) | 1; + } + } else { + for (j = 0; j < order; j++) { + dotprod += delayp[j] * (unsigned)coeffs[j]; + } } buffer[i] -= (unsigned)(dotprod >> shift); delayp ++;

1 0

avcodec/apedec: Move pointer instead of copying each element in delay in long_filter_high_3800()
by Michael Niedermayer 30 Apr '23

30 Apr '23

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Apr 23 23:51:38 2023 +0200| [eb768a75f8a0b347ab0f84c2c68959f5dbde6d4b] | committer: Michael Niedermayer avcodec/apedec: Move pointer instead of copying each element in delay in long_filter_high_3800() ~1000 -> 930 cycles Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=eb768a75f8a0b347a… --- libavcodec/apedec.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index c08d13d6c2..40cd78a991 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -944,7 +944,7 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len { int i, j; int32_t dotprod, sign; - int32_t coeffs[256], delay[256]; + int32_t coeffs[256], delay[256+256], *delayp = delay; if (order >= length) return; @@ -956,13 +956,16 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len dotprod = 0; sign = APESIGN(buffer[i]); for (j = 0; j < order; j++) { - dotprod += delay[j] * (unsigned)coeffs[j]; - coeffs[j] += ((delay[j] >> 31) | 1) * sign; + dotprod += delayp[j] * (unsigned)coeffs[j]; + coeffs[j] += ((delayp[j] >> 31) | 1) * sign; } buffer[i] -= (unsigned)(dotprod >> shift); - for (j = 0; j < order - 1; j++) - delay[j] = delay[j + 1]; - delay[order - 1] = buffer[i]; + delayp ++; + delayp[order - 1] = buffer[i]; + if (delayp - delay == 256) { + memcpy(delay, delayp, sizeof(*delay)*256); + delayp = delay; + } } }

1 0