Fixes: signed integer overflow: -1575944192 + -602931200 cannot be represented in type 'int' Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QOA_fuzzer-6470469339185152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
		
			
				
	
	
		
			171 lines
		
	
	
		
			5.9 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			171 lines
		
	
	
		
			5.9 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
| /*
 | |
|  * QOA decoder
 | |
|  *
 | |
|  * This file is part of FFmpeg.
 | |
|  *
 | |
|  * FFmpeg is free software; you can redistribute it and/or
 | |
|  * modify it under the terms of the GNU Lesser General Public
 | |
|  * License as published by the Free Software Foundation; either
 | |
|  * version 2.1 of the License, or (at your option) any later version.
 | |
|  *
 | |
|  * FFmpeg is distributed in the hope that it will be useful,
 | |
|  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 | |
|  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 | |
|  * Lesser General Public License for more details.
 | |
|  *
 | |
|  * You should have received a copy of the GNU Lesser General Public
 | |
|  * License along with FFmpeg; if not, write to the Free Software
 | |
|  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 | |
|  */
 | |
| 
 | |
| #include "avcodec.h"
 | |
| #include "codec_internal.h"
 | |
| #include "decode.h"
 | |
| #include "get_bits.h"
 | |
| #include "bytestream.h"
 | |
| #include "mathops.h"
 | |
| 
 | |
| #define QOA_SLICE_LEN 20
 | |
| #define QOA_LMS_LEN 4
 | |
| 
 | |
| typedef struct QOAChannel {
 | |
|     int history[QOA_LMS_LEN];
 | |
|     int weights[QOA_LMS_LEN];
 | |
| } QOAChannel;
 | |
| 
 | |
| typedef struct QOAContext {
 | |
|     QOAChannel ch[256];
 | |
| } QOAContext;
 | |
| 
 | |
| static const int16_t qoa_dequant_tab[16][8] = {
 | |
|     {   1,    -1,    3,    -3,    5,    -5,     7,     -7},
 | |
|     {   5,    -5,   18,   -18,   32,   -32,    49,    -49},
 | |
|     {  16,   -16,   53,   -53,   95,   -95,   147,   -147},
 | |
|     {  34,   -34,  113,  -113,  203,  -203,   315,   -315},
 | |
|     {  63,   -63,  210,  -210,  378,  -378,   588,   -588},
 | |
|     { 104,  -104,  345,  -345,  621,  -621,   966,   -966},
 | |
|     { 158,  -158,  528,  -528,  950,  -950,  1477,  -1477},
 | |
|     { 228,  -228,  760,  -760, 1368, -1368,  2128,  -2128},
 | |
|     { 316,  -316, 1053, -1053, 1895, -1895,  2947,  -2947},
 | |
|     { 422,  -422, 1405, -1405, 2529, -2529,  3934,  -3934},
 | |
|     { 548,  -548, 1828, -1828, 3290, -3290,  5117,  -5117},
 | |
|     { 696,  -696, 2320, -2320, 4176, -4176,  6496,  -6496},
 | |
|     { 868,  -868, 2893, -2893, 5207, -5207,  8099,  -8099},
 | |
|     {1064, -1064, 3548, -3548, 6386, -6386,  9933,  -9933},
 | |
|     {1286, -1286, 4288, -4288, 7718, -7718, 12005, -12005},
 | |
|     {1536, -1536, 5120, -5120, 9216, -9216, 14336, -14336},
 | |
| };
 | |
| 
 | |
| static av_cold int qoa_decode_init(AVCodecContext *avctx)
 | |
| {
 | |
|     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
 | |
| 
 | |
|     return 0;
 | |
| }
 | |
| 
 | |
| static int qoa_lms_predict(QOAChannel *lms)
 | |
| {
 | |
|     int prediction = 0;
 | |
|     for (int i = 0; i < QOA_LMS_LEN; i++)
 | |
|         prediction += (unsigned)lms->weights[i] * lms->history[i];
 | |
|     return prediction >> 13;
 | |
| }
 | |
| 
 | |
| static void qoa_lms_update(QOAChannel *lms, int sample, int residual)
 | |
| {
 | |
|     int delta = residual >> 4;
 | |
|     for (int i = 0; i < QOA_LMS_LEN; i++)
 | |
|         lms->weights[i] += lms->history[i] < 0 ? -delta : delta;
 | |
|     for (int i = 0; i < QOA_LMS_LEN-1; i++)
 | |
|         lms->history[i] = lms->history[i+1];
 | |
|     lms->history[QOA_LMS_LEN-1] = sample;
 | |
| }
 | |
| 
 | |
| static int qoa_decode_frame(AVCodecContext *avctx, AVFrame *frame,
 | |
|                             int *got_frame_ptr, AVPacket *avpkt)
 | |
| {
 | |
|     QOAContext *s = avctx->priv_data;
 | |
|     int ret, frame_size, nb_channels, sample_rate;
 | |
|     GetByteContext gb;
 | |
|     int16_t *samples;
 | |
| 
 | |
|     bytestream2_init(&gb, avpkt->data, avpkt->size);
 | |
| 
 | |
|     nb_channels = bytestream2_get_byte(&gb);
 | |
|     sample_rate = bytestream2_get_be24(&gb);
 | |
|     if (!sample_rate || !nb_channels)
 | |
|         return AVERROR_INVALIDDATA;
 | |
| 
 | |
|     if (nb_channels != avctx->ch_layout.nb_channels) {
 | |
|         av_channel_layout_uninit(&avctx->ch_layout);
 | |
|         av_channel_layout_default(&avctx->ch_layout, nb_channels);
 | |
|         if ((ret = av_channel_layout_copy(&frame->ch_layout, &avctx->ch_layout)) < 0)
 | |
|             return ret;
 | |
|     }
 | |
| 
 | |
|     frame->sample_rate = avctx->sample_rate = sample_rate;
 | |
| 
 | |
|     frame->nb_samples = bytestream2_get_be16(&gb);
 | |
|     frame_size = bytestream2_get_be16(&gb);
 | |
|     if (frame_size > avpkt->size)
 | |
|         return AVERROR_INVALIDDATA;
 | |
| 
 | |
|     if (avpkt->size < 8 + QOA_LMS_LEN * 4 * nb_channels +
 | |
|         8LL * ((frame->nb_samples + QOA_SLICE_LEN - 1) / QOA_SLICE_LEN) * nb_channels)
 | |
|         return AVERROR_INVALIDDATA;
 | |
| 
 | |
|     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
 | |
|         return ret;
 | |
|     samples = (int16_t *)frame->data[0];
 | |
| 
 | |
|     for (int ch = 0; ch < nb_channels; ch++) {
 | |
|         QOAChannel *qch = &s->ch[ch];
 | |
| 
 | |
|         for (int n = 0; n < QOA_LMS_LEN; n++)
 | |
|             qch->history[n] = sign_extend(bytestream2_get_be16u(&gb), 16);
 | |
|         for (int n = 0; n < QOA_LMS_LEN; n++)
 | |
|             qch->weights[n] = sign_extend(bytestream2_get_be16u(&gb), 16);
 | |
|     }
 | |
| 
 | |
|     for (int sample_index = 0; sample_index < frame->nb_samples;
 | |
|          sample_index += QOA_SLICE_LEN) {
 | |
|         for (int ch = 0; ch < nb_channels; ch++) {
 | |
|             QOAChannel *lms = &s->ch[ch];
 | |
|             uint64_t slice = bytestream2_get_be64u(&gb);
 | |
|             int scalefactor = (slice >> 60) & 0xf;
 | |
|             int slice_start = sample_index * nb_channels + ch;
 | |
|             int slice_end = av_clip(sample_index + QOA_SLICE_LEN, 0, frame->nb_samples) * nb_channels + ch;
 | |
| 
 | |
|             for (int si = slice_start; si < slice_end; si += nb_channels) {
 | |
|                 int predicted = qoa_lms_predict(lms);
 | |
|                 int quantized = (slice >> 57) & 0x7;
 | |
|                 int dequantized = qoa_dequant_tab[scalefactor][quantized];
 | |
|                 int reconstructed = av_clip_int16(predicted + dequantized);
 | |
| 
 | |
|                 samples[si] = reconstructed;
 | |
|                 slice <<= 3;
 | |
| 
 | |
|                 qoa_lms_update(lms, reconstructed, dequantized);
 | |
|             }
 | |
|         }
 | |
|     }
 | |
| 
 | |
|     *got_frame_ptr = 1;
 | |
| 
 | |
|     return avpkt->size;
 | |
| }
 | |
| 
 | |
| const FFCodec ff_qoa_decoder = {
 | |
|     .p.name         = "qoa",
 | |
|     CODEC_LONG_NAME("QOA (Quite OK Audio)"),
 | |
|     .p.type         = AVMEDIA_TYPE_AUDIO,
 | |
|     .p.id           = AV_CODEC_ID_QOA,
 | |
|     .priv_data_size = sizeof(QOAContext),
 | |
|     .init           = qoa_decode_init,
 | |
|     FF_CODEC_DECODE_CB(qoa_decode_frame),
 | |
|     .p.capabilities = AV_CODEC_CAP_CHANNEL_CONF |
 | |
|                       AV_CODEC_CAP_DR1,
 | |
|     .p.sample_fmts  = (const enum AVSampleFormat[]) { AV_SAMPLE_FMT_S16,
 | |
|                                                       AV_SAMPLE_FMT_NONE },
 | |
| };
 |