[FFmpeg-devel] [PATCH 1/2] avcodec/adpcm_data: extend ff_adpcm_ima_cunning_index_table

[Michael Niedermayer]

On Thu, May 28, 2020 at 02:06:32PM +0000, Zane van Iperen wrote:
> On Thu, 28 May 2020 14:12:33 +0200
> "Michael Niedermayer" <michael at niedermayer.cc> wrote:
> 
> > 
> > Fixes: overread by 1
> > Fixes:
> > 21880/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_CUNNING_fuzzer-5717917221257216.fuzz
> > 
> > Found-by: continuous fuzzing process
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > 
> > -const int8_t ff_adpcm_ima_cunning_index_table[8] = {
> > -    -1, -1, -1, -1, 1, 2, 3, 4,
> > +const int8_t ff_adpcm_ima_cunning_index_table[9] = {
> > +    -1, -1, -1, -1, 1, 2, 3, 4, 5
> >  };
> > 
> The index table should only ever be indexed between [0,7], so this
> looks like a bug in adpcm_ima_cunning_expand_nibble() instead. 

maybe it should be only 0..7 but abs(-8 .. 7) needs a 8th entrty or a
check


> 
> Where would one go to see the inputs for this? I'd like to investigate
> (and test against the original decoder).

The file is from a fuzzer so is random trash and it needs target_dec_fuzzer.c 
to be read. It wont be read as "Pro Pinball Series Soundbank"
so i think that file will not be useful to test the behavior of the original
decoder as i would assume it will not accept the target_dec_fuzzer data
but i surely can send it to you privatly if you need it.
just say if you want me to send you the file

Thanks

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

He who knows, does not speak. He who speaks, does not know. -- Lao Tsu
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20200528/713c5bee/attachment.sig>