har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/ffv1dec: restructure slice coordinate reading a bit

Browse Source 
Fixes: signed integer overflow: -1094995528 * 8224 cannot be represented in type 'int'
Fixes: 53508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-474551033462784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-11-22 23:34:22 +01:00
parent 1fdb65d2b7
commit 74b6ac7ebb
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 36 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
libavcodec/ffv1dec.c
View File

@ -168,24 +168,31 @@ static int decode_slice_header(const FFV1Context *f, FFV1Context *fs)
RangeCoder *c = &fs->c; RangeCoder *c = &fs->c;
uint8_t state[CONTEXT_SIZE]; uint8_t state[CONTEXT_SIZE];
unsigned ps, i, context_count; unsigned ps, i, context_count;
int sx, sy, sw, sh;
memset(state, 128, sizeof(state)); memset(state, 128, sizeof(state));
sx = get_symbol(c, state, 0);
sy = get_symbol(c, state, 0);
sw = get_symbol(c, state, 0) + 1U;
sh = get_symbol(c, state, 0) + 1U;
av_assert0(f->version > 2); av_assert0(f->version > 2);
fs->slice_x = get_symbol(c, state, 0) * f->width ;
fs->slice_y = get_symbol(c, state, 0) * f->height;
fs->slice_width = (get_symbol(c, state, 0) + 1) * f->width + fs->slice_x;
fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;
fs->slice_x /= f->num_h_slices; if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
fs->slice_y /= f->num_v_slices; return AVERROR_INVALIDDATA;
fs->slice_width = fs->slice_width /f->num_h_slices - fs->slice_x; if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
fs->slice_height = fs->slice_height/f->num_v_slices - fs->slice_y; return AVERROR_INVALIDDATA;
if ((unsigned)fs->slice_width > f->width || (unsigned)fs->slice_height > f->height)
return -1; fs->slice_x = sx * (int64_t)f->width / f->num_h_slices;
if ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width > f->width fs->slice_y = sy * (int64_t)f->height / f->num_v_slices;
|| (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height) fs->slice_width = (sx + sw) * (int64_t)f->width / f->num_h_slices - fs->slice_x;
return -1; fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
av_assert0((unsigned)fs->slice_width <= f->width &&
(unsigned)fs->slice_height <= f->height);
av_assert0 ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width <= f->width
&& (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
if (fs->ac == AC_GOLOMB_RICE && fs->slice_width >= (1<<23)) if (fs->ac == AC_GOLOMB_RICE && fs->slice_width >= (1<<23))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
@ -770,21 +777,25 @@ static int read_header(FFV1Context *f)
fs->slice_damaged = 0; fs->slice_damaged = 0;
if (f->version == 2) { if (f->version == 2) {
fs->slice_x = get_symbol(c, state, 0) * f->width ; int sx = get_symbol(c, state, 0);
fs->slice_y = get_symbol(c, state, 0) * f->height; int sy = get_symbol(c, state, 0);
fs->slice_width = (get_symbol(c, state, 0) + 1) * f->width + fs->slice_x; int sw = get_symbol(c, state, 0) + 1U;
fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y; int sh = get_symbol(c, state, 0) + 1U;
fs->slice_x /= f->num_h_slices; if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
fs->slice_y /= f->num_v_slices;
fs->slice_width = fs->slice_width / f->num_h_slices - fs->slice_x;
fs->slice_height = fs->slice_height / f->num_v_slices - fs->slice_y;
if ((unsigned)fs->slice_width > f->width ||
(unsigned)fs->slice_height > f->height)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width > f->width if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
|| (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
fs->slice_x = sx * (int64_t)f->width / f->num_h_slices;
fs->slice_y = sy * (int64_t)f->height / f->num_v_slices;
fs->slice_width = (sx + sw) * (int64_t)f->width / f->num_h_slices - fs->slice_x;
fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
av_assert0((unsigned)fs->slice_width <= f->width &&
(unsigned)fs->slice_height <= f->height);
av_assert0 ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width <= f->width
&& (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
} }
for (i = 0; i < f->plane_count; i++) { for (i = 0; i < f->plane_count; i++) {