RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/ffv1dec: restructure slice coordinate reading a bit 

Fixes: signed integer overflow: -1094995528 * 8224 cannot be represented in type 'int'
Fixes: 53508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-474551033462784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74b6ac7ebb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-11-22 23:34:22 +01:00
parent 82dc3224b7
commit 6c4135ae35
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 36 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
libavcodec/ffv1dec.c
View File

@ -169,24 +169,31 @@ static int decode_slice_header(FFV1Context *f, FFV1Context *fs)
RangeCoder *c = &fs->c;
uint8_t state[CONTEXT_SIZE];
unsigned ps, i, context_count;
int sx, sy, sw, sh;
memset(state, 128, sizeof(state));
sx = get_symbol(c, state, 0);
sy = get_symbol(c, state, 0);
sw = get_symbol(c, state, 0) + 1U;
sh = get_symbol(c, state, 0) + 1U;
av_assert0(f->version > 2);
fs->slice_x = get_symbol(c, state, 0) * f->width ;
fs->slice_y = get_symbol(c, state, 0) * f->height;
fs->slice_width = (get_symbol(c, state, 0) + 1) * f->width + fs->slice_x;
fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;
fs->slice_x /= f->num_h_slices;
fs->slice_y /= f->num_v_slices;
fs->slice_width = fs->slice_width /f->num_h_slices - fs->slice_x;
fs->slice_height = fs->slice_height/f->num_v_slices - fs->slice_y;
if ((unsigned)fs->slice_width > f->width || (unsigned)fs->slice_height > f->height)
return -1;
if ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width > f->width
|| (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
return -1;
if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
return AVERROR_INVALIDDATA;
if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
return AVERROR_INVALIDDATA;
fs->slice_x = sx * (int64_t)f->width / f->num_h_slices;
fs->slice_y = sy * (int64_t)f->height / f->num_v_slices;
fs->slice_width = (sx + sw) * (int64_t)f->width / f->num_h_slices - fs->slice_x;
fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
av_assert0((unsigned)fs->slice_width <= f->width &&
(unsigned)fs->slice_height <= f->height);
av_assert0 ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width <= f->width
&& (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
if (fs->ac == AC_GOLOMB_RICE && fs->slice_width >= (1<<23))
return AVERROR_INVALIDDATA;
@ -773,21 +780,25 @@ static int read_header(FFV1Context *f)
fs->slice_damaged = 0;
if (f->version == 2) {
fs->slice_x = get_symbol(c, state, 0) * f->width ;
fs->slice_y = get_symbol(c, state, 0) * f->height;
fs->slice_width = (get_symbol(c, state, 0) + 1) * f->width + fs->slice_x;
fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;
int sx = get_symbol(c, state, 0);
int sy = get_symbol(c, state, 0);
int sw = get_symbol(c, state, 0) + 1U;
int sh = get_symbol(c, state, 0) + 1U;
fs->slice_x /= f->num_h_slices;
fs->slice_y /= f->num_v_slices;
fs->slice_width = fs->slice_width / f->num_h_slices - fs->slice_x;
fs->slice_height = fs->slice_height / f->num_v_slices - fs->slice_y;
if ((unsigned)fs->slice_width > f->width ||
(unsigned)fs->slice_height > f->height)
if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
return AVERROR_INVALIDDATA;
if ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width > f->width
|| (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
return AVERROR_INVALIDDATA;
fs->slice_x = sx * (int64_t)f->width / f->num_h_slices;
fs->slice_y = sy * (int64_t)f->height / f->num_v_slices;
fs->slice_width = (sx + sw) * (int64_t)f->width / f->num_h_slices - fs->slice_x;
fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
av_assert0((unsigned)fs->slice_width <= f->width &&
(unsigned)fs->slice_height <= f->height);
av_assert0 ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width <= f->width
&& (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
}
for (i = 0; i < f->plane_count; i++) {