Re: [FFmpeg-devel] [PATCH 3/3] avcodec/alac: Check lpc_quant

2019-07-07 Thread Michael Niedermayer
On Wed, Jun 19, 2019 at 01:53:03AM +0200, Michael Niedermayer wrote:
> lpc_quant of 0 produces undefined behavior, thus disallow this.
> If valid samples use this then such a sample would be quite
> usefull to confirm the correct&lossles handling of this.
> 
> Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative
> Fixes: 
> 15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5656388535058432
> Fixes: 
> 15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5761238417539072
> Fixes: 
> 15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5767260766994432
> 
> Found-by: continuous fuzzing process 
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/alac.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

will apply

[...]
-- 
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Opposition brings concord. Out of discord comes the fairest harmony.
-- Heraclitus


signature.asc
Description: PGP signature
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/3] avcodec/alac: Check lpc_quant

2019-06-18 Thread Michael Niedermayer
lpc_quant of 0 produces undefined behavior, thus disallow this.
If valid samples use this then such a sample would be quite
usefull to confirm the correct&lossles handling of this.

Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative
Fixes: 
15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5656388535058432
Fixes: 
15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5761238417539072
Fixes: 
15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5767260766994432

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
---
 libavcodec/alac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/alac.c b/libavcodec/alac.c
index 2f44340661..c234d7153b 100644
--- a/libavcodec/alac.c
+++ b/libavcodec/alac.c
@@ -306,7 +306,7 @@ static int decode_element(AVCodecContext *avctx, AVFrame 
*frame, int ch_index,
 rice_history_mult[ch] = get_bits(&alac->gb, 3);
 lpc_order[ch] = get_bits(&alac->gb, 5);
 
-if (lpc_order[ch] >= alac->max_samples_per_frame)
+if (lpc_order[ch] >= alac->max_samples_per_frame || !lpc_quant[ch])
 return AVERROR_INVALIDDATA;
 
 /* read the predictor table */
-- 
2.21.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".