[FFmpeg-cvslog] avcodec/ffv1dec: restructure slice coordinate reading a bit
Michael Niedermayer
git at videolan.org
Thu Oct 19 14:30:25 EEST 2023
ffmpeg | branch: release/2.8 | Michael Niedermayer <michael at niedermayer.cc> | Tue Nov 22 23:34:22 2022 +0100| [83a444270415452eaf00668c973ed0018a4df681] | committer: Michael Niedermayer
avcodec/ffv1dec: restructure slice coordinate reading a bit
Fixes: signed integer overflow: -1094995528 * 8224 cannot be represented in type 'int'
Fixes: 53508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-474551033462784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 74b6ac7ebb5c1e06a5fdfa29f79a18599942dbfa)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=83a444270415452eaf00668c973ed0018a4df681
---
libavcodec/ffv1dec.c | 65 ++++++++++++++++++++++++++++++----------------------
1 file changed, 38 insertions(+), 27 deletions(-)
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index 4d9e5573d1..0888c3c2a7 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -284,24 +284,31 @@ static int decode_slice_header(FFV1Context *f, FFV1Context *fs)
RangeCoder *c = &fs->c;
uint8_t state[CONTEXT_SIZE];
unsigned ps, i, context_count;
+ int sx, sy, sw, sh;
+
memset(state, 128, sizeof(state));
+ sx = get_symbol(c, state, 0);
+ sy = get_symbol(c, state, 0);
+ sw = get_symbol(c, state, 0) + 1U;
+ sh = get_symbol(c, state, 0) + 1U;
av_assert0(f->version > 2);
- fs->slice_x = get_symbol(c, state, 0) * f->width ;
- fs->slice_y = get_symbol(c, state, 0) * f->height;
- fs->slice_width = (get_symbol(c, state, 0) + 1) * f->width + fs->slice_x;
- fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;
-
- fs->slice_x /= f->num_h_slices;
- fs->slice_y /= f->num_v_slices;
- fs->slice_width = fs->slice_width /f->num_h_slices - fs->slice_x;
- fs->slice_height = fs->slice_height/f->num_v_slices - fs->slice_y;
- if ((unsigned)fs->slice_width > f->width || (unsigned)fs->slice_height > f->height)
- return -1;
- if ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width > f->width
- || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
- return -1;
+
+ if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
+ return AVERROR_INVALIDDATA;
+ if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
+ return AVERROR_INVALIDDATA;
+
+ fs->slice_x = sx * (int64_t)f->width / f->num_h_slices;
+ fs->slice_y = sy * (int64_t)f->height / f->num_v_slices;
+ fs->slice_width = (sx + sw) * (int64_t)f->width / f->num_h_slices - fs->slice_x;
+ fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
+
+ av_assert0((unsigned)fs->slice_width <= f->width &&
+ (unsigned)fs->slice_height <= f->height);
+ av_assert0 ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width <= f->width
+ && (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
for (i = 0; i < f->plane_count; i++) {
PlaneContext * const p = &fs->plane[i];
@@ -817,21 +824,25 @@ static int read_header(FFV1Context *f)
fs->slice_damaged = 0;
if (f->version == 2) {
- fs->slice_x = get_symbol(c, state, 0) * f->width ;
- fs->slice_y = get_symbol(c, state, 0) * f->height;
- fs->slice_width = (get_symbol(c, state, 0) + 1) * f->width + fs->slice_x;
- fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;
-
- fs->slice_x /= f->num_h_slices;
- fs->slice_y /= f->num_v_slices;
- fs->slice_width = fs->slice_width / f->num_h_slices - fs->slice_x;
- fs->slice_height = fs->slice_height / f->num_v_slices - fs->slice_y;
- if ((unsigned)fs->slice_width > f->width ||
- (unsigned)fs->slice_height > f->height)
+ int sx = get_symbol(c, state, 0);
+ int sy = get_symbol(c, state, 0);
+ int sw = get_symbol(c, state, 0) + 1U;
+ int sh = get_symbol(c, state, 0) + 1U;
+
+ if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
return AVERROR_INVALIDDATA;
- if ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width > f->width
- || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
+ if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
return AVERROR_INVALIDDATA;
+
+ fs->slice_x = sx * (int64_t)f->width / f->num_h_slices;
+ fs->slice_y = sy * (int64_t)f->height / f->num_v_slices;
+ fs->slice_width = (sx + sw) * (int64_t)f->width / f->num_h_slices - fs->slice_x;
+ fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
+
+ av_assert0((unsigned)fs->slice_width <= f->width &&
+ (unsigned)fs->slice_height <= f->height);
+ av_assert0 ( (unsigned)fs->slice_x + (uint64_t)fs->slice_width <= f->width
+ && (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
}
for (i = 0; i < f->plane_count; i++) {
More information about the ffmpeg-cvslog
mailing list