December 2024 - ffmpeg-cvslog

avformat/rpl: Fix check for negative values
by Michael Niedermayer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Nov 18 04:09:11 2024 +0100| [eab65379bf89c55d8ec4bc6f00e04f15b37d3d85] | committer: Michael Niedermayer avformat/rpl: Fix check for negative values Fixes: signed integer overflow: 10 * -1923267925333400000 cannot be represented in type 'int64_t' (aka 'long') Fixes: 378891963/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5714338935013376 Found-by: ossfuzz Reported-by: Kacper Michajlow <kasper93(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=eab65379bf89c55d8… --- libavformat/rpl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rpl.c b/libavformat/rpl.c index e971d0588f..b30d769efb 100644 --- a/libavformat/rpl.c +++ b/libavformat/rpl.c @@ -102,7 +102,7 @@ static AVRational read_fps(const char* line, int* error) line++; for (; *line>='0' && *line<='9'; line++) { // Truncate any numerator too large to fit into an int64_t - if (num > (INT64_MAX - 9) / 10 || den > INT64_MAX / 10) + if (num > (INT64_MAX - 9) / 10ULL || den > INT64_MAX / 10ULL) break; num = 10 * num + (*line - '0'); den *= 10;

1 0

avfilter/buffersrc: check for valid sample rate
by James Almer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Mon Dec 30 00:25:41 2024 -0300| [1446e37d3d032e1452844778b3e6ba2c20f0c322] | committer: James Almer avfilter/buffersrc: check for valid sample rate A sample rate <= 0 is invalid. Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set. Fixes ticket #11385. Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1446e37d3d032e145… --- libavfilter/buffersrc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavfilter/buffersrc.c b/libavfilter/buffersrc.c index bdf8b14451..c921803c67 100644 --- a/libavfilter/buffersrc.c +++ b/libavfilter/buffersrc.c @@ -421,6 +421,11 @@ static av_cold int init_audio(AVFilterContext *ctx) av_channel_layout_describe(&s->ch_layout, buf, sizeof(buf)); } + if (s->sample_rate <= 0) { + av_log(ctx, AV_LOG_ERROR, "Sample rate not set\n"); + return AVERROR(EINVAL); + } + if (!s->time_base.num) s->time_base = (AVRational){1, s->sample_rate};

1 0

tests/checkasm/sw_rgb: remove bogus value truncation in check_yuv2packed1()
by James Almer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Tue Dec 31 11:53:18 2024 -0300| [658a645e183e16dbb2a26aba2fe22865e856a791] | committer: James Almer tests/checkasm/sw_rgb: remove bogus value truncation in check_yuv2packed1() Fixes out of array accesses. Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=658a645e183e16dbb… --- tests/checkasm/sw_rgb.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/tests/checkasm/sw_rgb.c b/tests/checkasm/sw_rgb.c index ac9a52192a..1db049ff26 100644 --- a/tests/checkasm/sw_rgb.c +++ b/tests/checkasm/sw_rgb.c @@ -571,8 +571,6 @@ static void check_yuv2packed1(void) src_a[i] &= 0x3FFF3FFF; src_u[i] &= 0x3FFF3FFF; src_v[i] &= 0x3FFF3FFF; - src_u[i + INPUT_SIZE] &= 0x3FFF3FFF; - src_v[i + INPUT_SIZE] &= 0x3FFF3FFF; } luma = (int16_t *)src_y;

1 0

avcodec/ac3dec: set preferred_stereo_downmix using the relevant coded value
by James Almer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Tue Dec 24 00:26:33 2024 -0300| [15b16d58df7d2372c6b7535633556e955ab97090] | committer: James Almer avcodec/ac3dec: set preferred_stereo_downmix using the relevant coded value Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=15b16d58df7d2372c… --- libavcodec/ac3dec.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index e5b52c577f..a796ddf44e 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -1611,6 +1611,20 @@ dependent_frame: s->loro_surround_mix_level = gain_levels[s->surround_mix_level]; s->ltrt_center_mix_level = gain_levels[s-> center_mix_level_ltrt]; s->ltrt_surround_mix_level = gain_levels[s->surround_mix_level_ltrt]; + switch (s->preferred_downmix) { + case AC3_DMIXMOD_LTRT: + s->preferred_stereo_downmix = AV_DOWNMIX_TYPE_LTRT; + break; + case AC3_DMIXMOD_LORO: + s->preferred_stereo_downmix = AV_DOWNMIX_TYPE_LORO; + break; + case AC3_DMIXMOD_DPLII: + s->preferred_stereo_downmix = AV_DOWNMIX_TYPE_DPLII; + break; + default: + s->preferred_stereo_downmix = AV_DOWNMIX_TYPE_UNKNOWN; + break; + } /* set downmixing coefficients if needed */ if (s->channels != s->out_channels && !((s->output_mode & AC3_OUTPUT_LFEON) && s->fbw_channels == s->out_channels)) {

1 0

avcodec/ac3dec_float: fix range for dmix_mode
by James Almer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Tue Dec 24 00:20:44 2024 -0300| [9d16c64134b1731f5aa98f9a31afa297b1193018] | committer: James Almer avcodec/ac3dec_float: fix range for dmix_mode Value 3 is used to signal "Dolby Pro Logic II" by some encoders. Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9d16c64134b1731f5… --- libavcodec/ac3dec_float.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ac3dec_float.c b/libavcodec/ac3dec_float.c index d1a48349e5..53d9d472c4 100644 --- a/libavcodec/ac3dec_float.c +++ b/libavcodec/ac3dec_float.c @@ -46,7 +46,7 @@ static const AVOption options[] = { { "heavy_compr", "enable heavy dynamic range compression", OFFSET(heavy_compression), AV_OPT_TYPE_BOOL, {.i64 = 0 }, 0, 1, PAR }, { "target_level", "target level in -dBFS (0 not applied)", OFFSET(target_level), AV_OPT_TYPE_INT, {.i64 = 0 }, -31, 0, PAR }, -{"dmix_mode", "Preferred Stereo Downmix Mode", OFFSET(preferred_stereo_downmix), AV_OPT_TYPE_INT, {.i64 = -1 }, -1, 2, EXPORT, .unit = "dmix_mode"}, +{"dmix_mode", "Preferred Stereo Downmix Mode", OFFSET(preferred_stereo_downmix), AV_OPT_TYPE_INT, {.i64 = -1 }, -1, 3, EXPORT, .unit = "dmix_mode"}, {"ltrt_cmixlev", "Lt/Rt Center Mix Level", OFFSET(ltrt_center_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, EXPORT }, {"ltrt_surmixlev", "Lt/Rt Surround Mix Level", OFFSET(ltrt_surround_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, EXPORT }, {"loro_cmixlev", "Lo/Ro Center Mix Level", OFFSET(loro_center_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, EXPORT },

1 0

avcodec/ac3dec_float: define the downmix related options as exported and read-only
by James Almer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Tue Dec 24 00:19:20 2024 -0300| [376bb8481ada994ffe16d0a02f6c8767bac21016] | committer: James Almer avcodec/ac3dec_float: define the downmix related options as exported and read-only They are not user settable options. Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=376bb8481ada994ff… --- libavcodec/ac3dec_float.c | 11 ++++++----- tests/ref/fate/ts-demux | 4 ++-- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/libavcodec/ac3dec_float.c b/libavcodec/ac3dec_float.c index d94070bc0c..d1a48349e5 100644 --- a/libavcodec/ac3dec_float.c +++ b/libavcodec/ac3dec_float.c @@ -39,17 +39,18 @@ #endif #include "ac3dec.c" +#define EXPORT (AV_OPT_FLAG_EXPORT | AV_OPT_FLAG_READONLY) static const AVOption options[] = { { "cons_noisegen", "enable consistent noise generation", OFFSET(consistent_noise_generation), AV_OPT_TYPE_BOOL, {.i64 = 0 }, 0, 1, PAR }, { "drc_scale", "percentage of dynamic range compression to apply", OFFSET(drc_scale), AV_OPT_TYPE_FLOAT, {.dbl = 1.0}, 0.0, 6.0, PAR }, { "heavy_compr", "enable heavy dynamic range compression", OFFSET(heavy_compression), AV_OPT_TYPE_BOOL, {.i64 = 0 }, 0, 1, PAR }, { "target_level", "target level in -dBFS (0 not applied)", OFFSET(target_level), AV_OPT_TYPE_INT, {.i64 = 0 }, -31, 0, PAR }, -{"dmix_mode", "Preferred Stereo Downmix Mode", OFFSET(preferred_stereo_downmix), AV_OPT_TYPE_INT, {.i64 = -1 }, -1, 2, 0, .unit = "dmix_mode"}, -{"ltrt_cmixlev", "Lt/Rt Center Mix Level", OFFSET(ltrt_center_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, 0}, -{"ltrt_surmixlev", "Lt/Rt Surround Mix Level", OFFSET(ltrt_surround_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, 0}, -{"loro_cmixlev", "Lo/Ro Center Mix Level", OFFSET(loro_center_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, 0}, -{"loro_surmixlev", "Lo/Ro Surround Mix Level", OFFSET(loro_surround_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, 0}, +{"dmix_mode", "Preferred Stereo Downmix Mode", OFFSET(preferred_stereo_downmix), AV_OPT_TYPE_INT, {.i64 = -1 }, -1, 2, EXPORT, .unit = "dmix_mode"}, +{"ltrt_cmixlev", "Lt/Rt Center Mix Level", OFFSET(ltrt_center_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, EXPORT }, +{"ltrt_surmixlev", "Lt/Rt Surround Mix Level", OFFSET(ltrt_surround_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, EXPORT }, +{"loro_cmixlev", "Lo/Ro Center Mix Level", OFFSET(loro_center_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, EXPORT }, +{"loro_surmixlev", "Lo/Ro Surround Mix Level", OFFSET(loro_surround_mix_level), AV_OPT_TYPE_FLOAT, {.dbl = -1.0 }, -1.0, 2.0, EXPORT }, { "downmix", "Request a specific channel layout from the decoder", OFFSET(downmix_layout), AV_OPT_TYPE_CHLAYOUT, {.str = NULL}, .flags = PAR }, diff --git a/tests/ref/fate/ts-demux b/tests/ref/fate/ts-demux index 69f79b5132..6a830d0d99 100644 --- a/tests/ref/fate/ts-demux +++ b/tests/ref/fate/ts-demux @@ -24,6 +24,6 @@ packet|codec_type=video|stream_index=0|pts=3912686363|pts_time=43474.292922|dts= packet|codec_type=audio|stream_index=1|pts=3912644825|pts_time=43473.831389|dts=3912644825|dts_time=43473.831389|duration=2880|duration_time=0.032000|size=906|pos=474888|flags=K__|data_hash=CRC32:0893d398 packet|codec_type=audio|stream_index=2|pts=3912645580|pts_time=43473.839778|dts=3912645580|dts_time=43473.839778|duration=2880|duration_time=0.032000|size=354|pos=491808|flags=K__|data_hash=CRC32:f5963fa6 stream|index=0|codec_name=mpeg2video|profile=4|codec_type=video|codec_tag_string=[2][0][0][0]|codec_tag=0x0002|width=1280|height=720|coded_width=0|coded_height=0|has_b_frames=1|sample_aspect_ratio=1:1|display_aspect_ratio=16:9|pix_fmt=yuv420p|level=4|color_range=tv|color_space=unknown|color_transfer=unknown|color_primaries=unknown|chroma_location=left|field_order=progressive|refs=1|ts_id=32776|ts_packetsize=188|id=0x31|r_frame_rate=60000/1001|avg_frame_rate=60000/1001|time_base=1/90000|start_pts=3912669846|start_time=43474.109400|duration_ts=19519|duration=0.216878|bit_rate=15000000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=15|extradata_size=150|extradata_hash=CRC32:53134fa8|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0| disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|side_datum/cpb_properties:side_data_type=CPB properties|side_datum/cpb_properties:max_bitrate=15000000|side_datum/cpb_properties:min_bitrate=0|side_datum/cpb_properties:avg_bitrate=0|side_datum/cpb_properties:buffer_size=9781248|side_datum/cpb_properties:vbv_delay=-1 -stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng -stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es +stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|dmix_mode=0|ltrt_cmixlev=0.000000|ltrt_surmixlev=0.000000|loro_cmixlev=0.000000|loro_surmixlev=0.000000|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0| disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng +stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|dmix_mode=0|ltrt_cmixlev=0.000000|ltrt_surmixlev=0.000000|loro_cmixlev=0.000000|loro_surmixlev=0.000000|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|dis position:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es format|filename=mp3ac325-4864-small.ts|nb_streams=3|nb_programs=1|nb_stream_groups=0|format_name=mpegts|start_time=43473.703389|duration=0.622889|size=512000|bit_rate=6575810|probe_score=50

1 0

avcodec/ac3dec: set ltrt_center_mix and ltrt_surround_mix using the relevant coded values
by James Almer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Tue Dec 24 00:18:24 2024 -0300| [61519a6e989f28e823bc708db00fd712faa4c94e] | committer: James Almer avcodec/ac3dec: set ltrt_center_mix and ltrt_surround_mix using the relevant coded values Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=61519a6e989f28e82… --- libavcodec/ac3dec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index 3cc20f32a9..e5b52c577f 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -1609,8 +1609,8 @@ dependent_frame: s->loro_center_mix_level = gain_levels[s-> center_mix_level]; s->loro_surround_mix_level = gain_levels[s->surround_mix_level]; - s->ltrt_center_mix_level = LEVEL_MINUS_3DB; - s->ltrt_surround_mix_level = LEVEL_MINUS_3DB; + s->ltrt_center_mix_level = gain_levels[s-> center_mix_level_ltrt]; + s->ltrt_surround_mix_level = gain_levels[s->surround_mix_level_ltrt]; /* set downmixing coefficients if needed */ if (s->channels != s->out_channels && !((s->output_mode & AC3_OUTPUT_LFEON) && s->fbw_channels == s->out_channels)) {

1 0

avformat/mlvdec: Check avio_read()
by Michael Niedermayer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Dec 25 05:13:02 2024 +0100| [bb85423142103d694d97bad1967bd3dc55440e71] | committer: Michael Niedermayer avformat/mlvdec: Check avio_read() Fixes: use-of-uninitialized-value Fixes: 383170476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-4696002884337664 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross(a)xvid.org> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bb85423142103d694… --- libavformat/mlvdec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/mlvdec.c b/libavformat/mlvdec.c index 1a6d38f37c..985365326e 100644 --- a/libavformat/mlvdec.c +++ b/libavformat/mlvdec.c @@ -82,13 +82,15 @@ static int check_file_header(AVIOContext *pb, uint64_t guid) static void read_string(AVFormatContext *avctx, AVIOContext *pb, const char *tag, unsigned size) { char * value = av_malloc(size + 1); + int ret; + if (!value) { avio_skip(pb, size); return; } - avio_read(pb, value, size); - if (!value[0]) { + ret = avio_read(pb, value, size); + if (ret != size || !value[0]) { av_free(value); return; }

1 0

avformat/mxfdec: Check llen addition for overflow
by Michael Niedermayer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Dec 25 04:54:32 2024 +0100| [53db3516542c68f5ec92c5cdf8c13d76700ca9d5] | committer: Michael Niedermayer avformat/mxfdec: Check llen addition for overflow Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long' Fixes: 377971441/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4966030696316928 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=53db3516542c68f5e… --- libavformat/mxfdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 9ecaa287bb..0d97b3aade 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -496,6 +496,9 @@ static int klv_read_packet(MXFContext *mxf, KLVPacket *klv, AVIOContext *pb) if (length < 0) return length; klv->length = length; + if (klv->offset > INT64_MAX - 16 - llen) + return AVERROR_INVALIDDATA; + pos = klv->offset + 16 + llen; if (pos > INT64_MAX - length) return AVERROR_INVALIDDATA;

1 0

avcodec/aac/aacdec: Free channel layout
by Michael Niedermayer 31 Dec '24

31 Dec '24

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Dec 24 21:30:32 2024 +0100| [ae81beb3512855eae1eab3ce9a87cb0d4399fc67] | committer: Michael Niedermayer avcodec/aac/aacdec: Free channel layout Fixes: 371445194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5981081124274176 Fixes: memleak Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Lynne <dev(a)lynne.ee> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ae81beb3512855eae… --- libavcodec/aac/aacdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c index 717ad8aa90..e76392c88d 100644 --- a/libavcodec/aac/aacdec.c +++ b/libavcodec/aac/aacdec.c @@ -1104,6 +1104,8 @@ static av_cold int decode_close(AVCodecContext *avctx) for (int i = 0; i < 2; i++) { OutputConfiguration *oc = &ac->oc[i]; + av_channel_layout_uninit(&ac->oc[i].ch_layout); + AACUSACConfig *usac = &oc->usac; for (int j = 0; j < usac->nb_elems; j++) { AACUsacElemConfig *ec = &usac->elems[j];

1 0