Fixes: signed integer overflow: -159584 * 5105950 cannot be represented in type 'int' Fixes: 55165/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5796023719297024 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
		
			
				
	
	
		
			439 lines
		
	
	
		
			12 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			439 lines
		
	
	
		
			12 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
/*
 | 
						|
 * Bonk audio decoder
 | 
						|
 *
 | 
						|
 * This file is part of FFmpeg.
 | 
						|
 *
 | 
						|
 * FFmpeg is free software; you can redistribute it and/or
 | 
						|
 * modify it under the terms of the GNU Lesser General Public
 | 
						|
 * License as published by the Free Software Foundation; either
 | 
						|
 * version 2.1 of the License, or (at your option) any later version.
 | 
						|
 *
 | 
						|
 * FFmpeg is distributed in the hope that it will be useful,
 | 
						|
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 | 
						|
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 | 
						|
 * Lesser General Public License for more details.
 | 
						|
 *
 | 
						|
 * You should have received a copy of the GNU Lesser General Public
 | 
						|
 * License along with FFmpeg; if not, write to the Free Software
 | 
						|
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 | 
						|
 */
 | 
						|
 | 
						|
#include "libavutil/internal.h"
 | 
						|
#include "libavutil/intreadwrite.h"
 | 
						|
#include "avcodec.h"
 | 
						|
#include "codec_internal.h"
 | 
						|
#include "decode.h"
 | 
						|
#define BITSTREAM_READER_LE
 | 
						|
#include "get_bits.h"
 | 
						|
#include "bytestream.h"
 | 
						|
 | 
						|
typedef struct BitCount {
 | 
						|
    uint8_t bit;
 | 
						|
    unsigned count;
 | 
						|
} BitCount;
 | 
						|
 | 
						|
typedef struct BonkContext {
 | 
						|
    GetBitContext gb;
 | 
						|
    int skip;
 | 
						|
 | 
						|
    uint8_t *bitstream;
 | 
						|
    int64_t max_framesize;
 | 
						|
    int bitstream_size;
 | 
						|
    int bitstream_index;
 | 
						|
 | 
						|
    uint64_t nb_samples;
 | 
						|
    int lossless;
 | 
						|
    int mid_side;
 | 
						|
    int n_taps;
 | 
						|
    int down_sampling;
 | 
						|
    int samples_per_packet;
 | 
						|
 | 
						|
    int state[2][2048], k[2048];
 | 
						|
    int *samples[2];
 | 
						|
    int *input_samples;
 | 
						|
    uint8_t quant[2048];
 | 
						|
    BitCount *bits;
 | 
						|
} BonkContext;
 | 
						|
 | 
						|
static av_cold int bonk_close(AVCodecContext *avctx)
 | 
						|
{
 | 
						|
    BonkContext *s = avctx->priv_data;
 | 
						|
 | 
						|
    av_freep(&s->bitstream);
 | 
						|
    av_freep(&s->input_samples);
 | 
						|
    av_freep(&s->samples[0]);
 | 
						|
    av_freep(&s->samples[1]);
 | 
						|
    av_freep(&s->bits);
 | 
						|
    s->bitstream_size = 0;
 | 
						|
 | 
						|
    return 0;
 | 
						|
}
 | 
						|
 | 
						|
static av_cold int bonk_init(AVCodecContext *avctx)
 | 
						|
{
 | 
						|
    BonkContext *s = avctx->priv_data;
 | 
						|
 | 
						|
    avctx->sample_fmt = AV_SAMPLE_FMT_S16P;
 | 
						|
    if (avctx->extradata_size < 17)
 | 
						|
        return AVERROR(EINVAL);
 | 
						|
 | 
						|
    if (avctx->extradata[0]) {
 | 
						|
        av_log(avctx, AV_LOG_ERROR, "Unsupported version.\n");
 | 
						|
        return AVERROR_INVALIDDATA;
 | 
						|
    }
 | 
						|
 | 
						|
    if (avctx->ch_layout.nb_channels < 1 || avctx->ch_layout.nb_channels > 2)
 | 
						|
        return AVERROR_INVALIDDATA;
 | 
						|
 | 
						|
    s->nb_samples = AV_RL32(avctx->extradata + 1) / avctx->ch_layout.nb_channels;
 | 
						|
    if (!s->nb_samples)
 | 
						|
        s->nb_samples = UINT64_MAX;
 | 
						|
    s->lossless = avctx->extradata[10] != 0;
 | 
						|
    s->mid_side = avctx->extradata[11] != 0;
 | 
						|
    s->n_taps = AV_RL16(avctx->extradata + 12);
 | 
						|
    if (!s->n_taps || s->n_taps > 2048)
 | 
						|
        return AVERROR(EINVAL);
 | 
						|
 | 
						|
    s->down_sampling = avctx->extradata[14];
 | 
						|
    if (!s->down_sampling)
 | 
						|
        return AVERROR(EINVAL);
 | 
						|
 | 
						|
    s->samples_per_packet = AV_RL16(avctx->extradata + 15);
 | 
						|
    if (!s->samples_per_packet)
 | 
						|
        return AVERROR(EINVAL);
 | 
						|
 | 
						|
    if (s->down_sampling * s->samples_per_packet < s->n_taps)
 | 
						|
        return AVERROR_INVALIDDATA;
 | 
						|
 | 
						|
    s->max_framesize = s->samples_per_packet * avctx->ch_layout.nb_channels * s->down_sampling * 16LL;
 | 
						|
    if (s->max_framesize > (INT32_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 8)
 | 
						|
        return AVERROR_INVALIDDATA;
 | 
						|
 | 
						|
    s->bitstream = av_calloc(s->max_framesize + AV_INPUT_BUFFER_PADDING_SIZE, sizeof(*s->bitstream));
 | 
						|
    if (!s->bitstream)
 | 
						|
        return AVERROR(ENOMEM);
 | 
						|
 | 
						|
    s->input_samples = av_calloc(s->samples_per_packet, sizeof(*s->input_samples));
 | 
						|
    if (!s->input_samples)
 | 
						|
        return AVERROR(ENOMEM);
 | 
						|
 | 
						|
    s->samples[0] = av_calloc(s->samples_per_packet * s->down_sampling, sizeof(*s->samples[0]));
 | 
						|
    s->samples[1] = av_calloc(s->samples_per_packet * s->down_sampling, sizeof(*s->samples[0]));
 | 
						|
    if (!s->samples[0] || !s->samples[1])
 | 
						|
        return AVERROR(ENOMEM);
 | 
						|
 | 
						|
    s->bits = av_calloc(s->max_framesize * 8, sizeof(*s->bits));
 | 
						|
    if (!s->bits)
 | 
						|
        return AVERROR(ENOMEM);
 | 
						|
 | 
						|
    for (int i = 0; i < 512; i++) {
 | 
						|
        s->quant[i] = sqrt(i + 1);
 | 
						|
    }
 | 
						|
 | 
						|
    return 0;
 | 
						|
}
 | 
						|
 | 
						|
static unsigned read_uint_max(BonkContext *s, uint32_t max)
 | 
						|
{
 | 
						|
    unsigned value = 0;
 | 
						|
 | 
						|
    if (max == 0)
 | 
						|
        return 0;
 | 
						|
 | 
						|
    av_assert0(max >> 31 == 0);
 | 
						|
 | 
						|
    for (unsigned i = 1; i <= max - value; i+=i)
 | 
						|
        if (get_bits1(&s->gb))
 | 
						|
            value += i;
 | 
						|
 | 
						|
    return value;
 | 
						|
}
 | 
						|
 | 
						|
static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
 | 
						|
{
 | 
						|
    int i, low_bits = 0, x = 0, max_x;
 | 
						|
    int n_zeros = 0, step = 256, dominant = 0;
 | 
						|
    int pos = 0, level = 0;
 | 
						|
    BitCount *bits = s->bits;
 | 
						|
    int passes = 1;
 | 
						|
 | 
						|
    memset(buf, 0, entries * sizeof(*buf));
 | 
						|
    if (base_2_part) {
 | 
						|
        low_bits = get_bits(&s->gb, 4);
 | 
						|
 | 
						|
        if (low_bits)
 | 
						|
            for (i = 0; i < entries; i++)
 | 
						|
                buf[i] = get_bits(&s->gb, low_bits);
 | 
						|
    }
 | 
						|
 | 
						|
    while (n_zeros < entries) {
 | 
						|
        int steplet = step >> 8;
 | 
						|
 | 
						|
        if (get_bits_left(&s->gb) <= 0)
 | 
						|
            return AVERROR_INVALIDDATA;
 | 
						|
 | 
						|
        if (!get_bits1(&s->gb)) {
 | 
						|
            av_assert0(steplet >= 0);
 | 
						|
 | 
						|
            if (steplet > 0) {
 | 
						|
                bits[x  ].bit   = dominant;
 | 
						|
                bits[x++].count = steplet;
 | 
						|
            }
 | 
						|
 | 
						|
            if (!dominant)
 | 
						|
                n_zeros += steplet;
 | 
						|
 | 
						|
            if (step > INT32_MAX*8LL/9 + 1)
 | 
						|
                return AVERROR_INVALIDDATA;
 | 
						|
            step += step / 8;
 | 
						|
        } else if (steplet > 0) {
 | 
						|
            int actual_run = read_uint_max(s, steplet - 1);
 | 
						|
 | 
						|
            av_assert0(actual_run >= 0);
 | 
						|
 | 
						|
            if (actual_run > 0) {
 | 
						|
                bits[x  ].bit   = dominant;
 | 
						|
                bits[x++].count = actual_run;
 | 
						|
            }
 | 
						|
 | 
						|
            bits[x  ].bit   = !dominant;
 | 
						|
            bits[x++].count = 1;
 | 
						|
 | 
						|
            if (!dominant)
 | 
						|
                n_zeros += actual_run;
 | 
						|
            else
 | 
						|
                n_zeros++;
 | 
						|
 | 
						|
            step -= step / 8;
 | 
						|
        }
 | 
						|
 | 
						|
        if (step < 256) {
 | 
						|
            step = 65536 / step;
 | 
						|
            dominant = !dominant;
 | 
						|
        }
 | 
						|
    }
 | 
						|
 | 
						|
    max_x = x;
 | 
						|
    x = 0;
 | 
						|
    n_zeros = 0;
 | 
						|
    for (i = 0; n_zeros < entries; i++) {
 | 
						|
        if (x >= max_x)
 | 
						|
            return AVERROR_INVALIDDATA;
 | 
						|
 | 
						|
        if (pos >= entries) {
 | 
						|
            pos = 0;
 | 
						|
            level += passes << low_bits;
 | 
						|
            passes = 1;
 | 
						|
            if (bits[x].bit && bits[x].count > entries - n_zeros)
 | 
						|
                passes =  bits[x].count / (entries - n_zeros);
 | 
						|
        }
 | 
						|
 | 
						|
        if (level > 1 << 16)
 | 
						|
            return AVERROR_INVALIDDATA;
 | 
						|
 | 
						|
        if (buf[pos] >= level) {
 | 
						|
            if (bits[x].bit)
 | 
						|
                buf[pos] += passes << low_bits;
 | 
						|
            else
 | 
						|
                n_zeros++;
 | 
						|
 | 
						|
            av_assert1(bits[x].count >= passes);
 | 
						|
            bits[x].count -= passes;
 | 
						|
            x += bits[x].count == 0;
 | 
						|
        }
 | 
						|
 | 
						|
        pos++;
 | 
						|
    }
 | 
						|
 | 
						|
    for (i = 0; i < entries; i++) {
 | 
						|
        if (buf[i] && get_bits1(&s->gb)) {
 | 
						|
            buf[i] = -buf[i];
 | 
						|
        }
 | 
						|
    }
 | 
						|
 | 
						|
    return 0;
 | 
						|
}
 | 
						|
 | 
						|
static inline int shift_down(int a, int b)
 | 
						|
{
 | 
						|
    return (a >> b) + (a < 0);
 | 
						|
}
 | 
						|
 | 
						|
static inline int shift(int a, int b)
 | 
						|
{
 | 
						|
    return a + (1 << b - 1) >> b;
 | 
						|
}
 | 
						|
 | 
						|
#define LATTICE_SHIFT 10
 | 
						|
#define SAMPLE_SHIFT   4
 | 
						|
#define SAMPLE_FACTOR (1 << SAMPLE_SHIFT)
 | 
						|
 | 
						|
static int predictor_calc_error(int *k, int *state, int order, int error)
 | 
						|
{
 | 
						|
    int i, x = error - shift_down(k[order-1] * (unsigned)state[order-1], LATTICE_SHIFT);
 | 
						|
    int *k_ptr = &(k[order-2]),
 | 
						|
        *state_ptr = &(state[order-2]);
 | 
						|
 | 
						|
    for (i = order-2; i >= 0; i--, k_ptr--, state_ptr--) {
 | 
						|
        unsigned k_value = *k_ptr, state_value = *state_ptr;
 | 
						|
 | 
						|
        x -= shift_down(k_value * (unsigned)state_value, LATTICE_SHIFT);
 | 
						|
        state_ptr[1] = state_value + shift_down(k_value * x, LATTICE_SHIFT);
 | 
						|
    }
 | 
						|
 | 
						|
    // don't drift too far, to avoid overflows
 | 
						|
    x = av_clip(x, -(SAMPLE_FACTOR << 16), SAMPLE_FACTOR << 16);
 | 
						|
 | 
						|
    state[0] = x;
 | 
						|
 | 
						|
    return x;
 | 
						|
}
 | 
						|
 | 
						|
static void predictor_init_state(int *k, unsigned *state, int order)
 | 
						|
{
 | 
						|
    for (int i = order - 2; i >= 0; i--) {
 | 
						|
        unsigned x = state[i];
 | 
						|
 | 
						|
        for (int j = 0, p = i + 1; p < order; j++, p++) {
 | 
						|
            int tmp = x + shift_down(k[j] * state[p], LATTICE_SHIFT);
 | 
						|
 | 
						|
            state[p] += shift_down(k[j] * x, LATTICE_SHIFT);
 | 
						|
            x = tmp;
 | 
						|
        }
 | 
						|
    }
 | 
						|
}
 | 
						|
 | 
						|
static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
 | 
						|
                       int *got_frame_ptr, AVPacket *pkt)
 | 
						|
{
 | 
						|
    BonkContext *s = avctx->priv_data;
 | 
						|
    GetBitContext *gb = &s->gb;
 | 
						|
    const uint8_t *buf;
 | 
						|
    int quant, n, buf_size, input_buf_size;
 | 
						|
    int ret = AVERROR_INVALIDDATA;
 | 
						|
 | 
						|
    if ((!pkt->size && !s->bitstream_size) || s->nb_samples == 0) {
 | 
						|
        *got_frame_ptr = 0;
 | 
						|
        return pkt->size;
 | 
						|
    }
 | 
						|
 | 
						|
    buf_size = FFMIN(pkt->size, s->max_framesize - s->bitstream_size);
 | 
						|
    input_buf_size = buf_size;
 | 
						|
    if (s->bitstream_index + s->bitstream_size + buf_size + AV_INPUT_BUFFER_PADDING_SIZE > s->max_framesize) {
 | 
						|
        memmove(s->bitstream, &s->bitstream[s->bitstream_index], s->bitstream_size);
 | 
						|
        s->bitstream_index = 0;
 | 
						|
    }
 | 
						|
    if (pkt->data)
 | 
						|
        memcpy(&s->bitstream[s->bitstream_index + s->bitstream_size], pkt->data, buf_size);
 | 
						|
    buf                = &s->bitstream[s->bitstream_index];
 | 
						|
    buf_size          += s->bitstream_size;
 | 
						|
    s->bitstream_size  = buf_size;
 | 
						|
    if (buf_size < s->max_framesize && pkt->data) {
 | 
						|
        *got_frame_ptr = 0;
 | 
						|
        return input_buf_size;
 | 
						|
    }
 | 
						|
 | 
						|
    frame->nb_samples = FFMIN(s->samples_per_packet * s->down_sampling, s->nb_samples);
 | 
						|
    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
 | 
						|
        goto fail;
 | 
						|
 | 
						|
    if ((ret = init_get_bits8(gb, buf, buf_size)) < 0)
 | 
						|
        goto fail;
 | 
						|
 | 
						|
    skip_bits(gb, s->skip);
 | 
						|
    if ((ret = intlist_read(s, s->k, s->n_taps, 0)) < 0)
 | 
						|
        goto fail;
 | 
						|
 | 
						|
    for (int i = 0; i < s->n_taps; i++)
 | 
						|
        s->k[i] *= s->quant[i];
 | 
						|
    quant = s->lossless ? 1 : get_bits(&s->gb, 16) * SAMPLE_FACTOR;
 | 
						|
 | 
						|
    for (int ch = 0; ch < avctx->ch_layout.nb_channels; ch++) {
 | 
						|
        const int samples_per_packet = s->samples_per_packet;
 | 
						|
        const int down_sampling = s->down_sampling;
 | 
						|
        const int offset = samples_per_packet * down_sampling - 1;
 | 
						|
        int *state = s->state[ch];
 | 
						|
        int *sample = s->samples[ch];
 | 
						|
 | 
						|
        predictor_init_state(s->k, state, s->n_taps);
 | 
						|
        if ((ret = intlist_read(s, s->input_samples, samples_per_packet, 1)) < 0)
 | 
						|
            goto fail;
 | 
						|
 | 
						|
        for (int i = 0; i < samples_per_packet; i++) {
 | 
						|
            for (int j = 0; j < s->down_sampling - 1; j++) {
 | 
						|
                sample[0] = predictor_calc_error(s->k, state, s->n_taps, 0);
 | 
						|
                sample++;
 | 
						|
            }
 | 
						|
 | 
						|
            sample[0] = predictor_calc_error(s->k, state, s->n_taps, s->input_samples[i] * (unsigned)quant);
 | 
						|
            sample++;
 | 
						|
        }
 | 
						|
 | 
						|
        sample = s->samples[ch];
 | 
						|
        for (int i = 0; i < s->n_taps; i++)
 | 
						|
            state[i] = sample[offset - i];
 | 
						|
    }
 | 
						|
 | 
						|
    if (s->mid_side && avctx->ch_layout.nb_channels == 2) {
 | 
						|
        for (int i = 0; i < frame->nb_samples; i++) {
 | 
						|
            s->samples[1][i] += shift(s->samples[0][i], 1);
 | 
						|
            s->samples[0][i] -= s->samples[1][i];
 | 
						|
        }
 | 
						|
    }
 | 
						|
 | 
						|
    if (!s->lossless) {
 | 
						|
        for (int ch = 0; ch < avctx->ch_layout.nb_channels; ch++) {
 | 
						|
            int *samples = s->samples[ch];
 | 
						|
            for (int i = 0; i < frame->nb_samples; i++)
 | 
						|
                samples[i] = shift(samples[i], 4);
 | 
						|
        }
 | 
						|
    }
 | 
						|
 | 
						|
    for (int ch = 0; ch < avctx->ch_layout.nb_channels; ch++) {
 | 
						|
        int16_t *osamples = (int16_t *)frame->extended_data[ch];
 | 
						|
        int *samples = s->samples[ch];
 | 
						|
        for (int i = 0; i < frame->nb_samples; i++)
 | 
						|
            osamples[i] = av_clip_int16(samples[i]);
 | 
						|
    }
 | 
						|
 | 
						|
    s->nb_samples -= frame->nb_samples;
 | 
						|
 | 
						|
    s->skip = get_bits_count(gb) - 8 * (get_bits_count(gb) / 8);
 | 
						|
    n = get_bits_count(gb) / 8;
 | 
						|
 | 
						|
    if (n > buf_size) {
 | 
						|
fail:
 | 
						|
        s->bitstream_size = 0;
 | 
						|
        s->bitstream_index = 0;
 | 
						|
        return AVERROR_INVALIDDATA;
 | 
						|
    }
 | 
						|
 | 
						|
    *got_frame_ptr = 1;
 | 
						|
 | 
						|
    if (s->bitstream_size) {
 | 
						|
        s->bitstream_index += n;
 | 
						|
        s->bitstream_size  -= n;
 | 
						|
        return input_buf_size;
 | 
						|
    }
 | 
						|
    return n;
 | 
						|
}
 | 
						|
 | 
						|
const FFCodec ff_bonk_decoder = {
 | 
						|
    .p.name           = "bonk",
 | 
						|
    CODEC_LONG_NAME("Bonk audio"),
 | 
						|
    .p.type           = AVMEDIA_TYPE_AUDIO,
 | 
						|
    .p.id             = AV_CODEC_ID_BONK,
 | 
						|
    .priv_data_size   = sizeof(BonkContext),
 | 
						|
    .init             = bonk_init,
 | 
						|
    FF_CODEC_DECODE_CB(bonk_decode),
 | 
						|
    .close            = bonk_close,
 | 
						|
    .p.capabilities   = AV_CODEC_CAP_DELAY |
 | 
						|
#if FF_API_SUBFRAMES
 | 
						|
                        AV_CODEC_CAP_SUBFRAMES |
 | 
						|
#endif
 | 
						|
                        AV_CODEC_CAP_DR1,
 | 
						|
    .caps_internal    = FF_CODEC_CAP_INIT_CLEANUP,
 | 
						|
    .p.sample_fmts    = (const enum AVSampleFormat[]) { AV_SAMPLE_FMT_S16P,
 | 
						|
                                                        AV_SAMPLE_FMT_NONE },
 | 
						|
};
 |