[FFmpeg-devel] [PATCH 3/4] avcodec/vorbisdec: Check vlc for floor0 dec vector offset

[Michael Niedermayer]

On Sun, Jul 21, 2019 at 11:27:44AM +0200, Paul B Mahol wrote:
> On 7/21/19, Michael Niedermayer <michael at niedermayer.cc> wrote:
> > On Mon, Jul 08, 2019 at 01:18:04AM +0200, Michael Niedermayer wrote:
> >> Fixes: out of array access
> >> Fixes:
> >> 15649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5729191309344768
> >>
> >> Found-by: continuous fuzzing process
> >> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> >> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> >> ---
> >>  libavcodec/vorbisdec.c | 6 ++++--
> >>  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > will apply
> 
> Are you sure returning that value is correct approach?
> 
> Correct value to return is usually INVALIDDATA.

the only call of this function i see does not use the value if it is
negative and uses INVALIDDATA instead.

        ret = floor->decode(vc, &floor->data, floor_ptr[i]);

        if (ret < 0) {
            av_log(vc->avctx, AV_LOG_ERROR, "Invalid codebook in vorbis_floor_decode.\n");
            return AVERROR_INVALIDDATA;
        }

but ill replace the code in this patch by an explicit AVERROR_INVALIDDATA
before pushing

Thanks
        
[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

it is not once nor twice but times without number that the same ideas make
their appearance in the world. -- Aristotle
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20190721/6f463f47/attachment.sig>