Re: [FFmpeg-devel] [PATCH 2/2] avcodec/zmbv: Check that the decompressed data is large enough to contain MVs or an intra frame

2018-09-17 Thread Michael Niedermayer 
On Mon, Sep 17, 2018 at 09:34:00PM +0200, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 
> 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704
> 
> Found-by: continuous fuzzing process 
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/zmbv.c | 11 ++-
>  1 file changed, 10 insertions(+), 1 deletion(-)

will submit a slightly different solution based on discussion with
durandal on IRC

[...]
-- 
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Its not that you shouldnt use gotos but rather that you should write
readable code and code with gotos often but not always is less readable


signature.asc
Description: PGP signature
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 2/2] avcodec/zmbv: Check that the decompressed data is large enough to contain MVs or an intra frame

2018-09-17 Thread Paul B Mahol 
On 9/17/18, Michael Niedermayer  wrote:
> Fixes: Timeout
> Fixes:
> 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/zmbv.c | 11 ++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c
> index 177993d0a6..0c2daf47c2 100644
> --- a/libavcodec/zmbv.c
> +++ b/libavcodec/zmbv.c
> @@ -409,6 +409,7 @@ static int decode_frame(AVCodecContext *avctx, void
> *data, int *got_frame, AVPac
>  int zret = Z_OK; // Zlib return code
>  int len = buf_size;
>  int hi_ver, lo_ver, ret;
> +int min_size;
>
>  /* parse header */
>  if (len < 1)
> @@ -510,7 +511,11 @@ static int decode_frame(AVCodecContext *avctx, void
> *data, int *got_frame, AVPac
>  memset(c->prev, 0, avctx->width * avctx->height * (c->bpp / 8));
>  c->decode_intra= decode_intra;
>  }
> -
> +if (c->flags & ZMBV_KEYFRAME) {
> +min_size = avctx->width * avctx->height * (c->bpp / 8);

Do you have proof this is really minimal possible thing zlib can
compress single frame?
If not, Drop. It.

> +} else {
> +min_size = (c->bx * c->by * 2 + 3) & ~3;
> +}
>  if (!c->decode_intra) {
>  av_log(avctx, AV_LOG_ERROR, "Error! Got no format or no
> keyframe!\n");
>  return AVERROR_INVALIDDATA;
> @@ -539,6 +544,10 @@ static int decode_frame(AVCodecContext *avctx, void
> *data, int *got_frame, AVPac
>  }
>  c->decomp_len = c->zstream.total_out;
>  }
> +if (min_size > c->decomp_len) {
> +av_log(avctx, AV_LOG_ERROR, "input too small\n");
> +return AVERROR_INVALIDDATA;
> +}
>  if (c->flags & ZMBV_KEYFRAME) {
>  frame->key_frame = 1;
>  frame->pict_type = AV_PICTURE_TYPE_I;
> --
> 2.18.0
>
> ___
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH 2/2] avcodec/zmbv: Check that the decompressed data is large enough to contain MVs or an intra frame

2018-09-17 Thread Michael Niedermayer 
Fixes: Timeout
Fixes: 
10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
---
 libavcodec/zmbv.c | 11 ++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c
index 177993d0a6..0c2daf47c2 100644
--- a/libavcodec/zmbv.c
+++ b/libavcodec/zmbv.c
@@ -409,6 +409,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, 
int *got_frame, AVPac
 int zret = Z_OK; // Zlib return code
 int len = buf_size;
 int hi_ver, lo_ver, ret;
+int min_size;
 
 /* parse header */
 if (len < 1)
@@ -510,7 +511,11 @@ static int decode_frame(AVCodecContext *avctx, void *data, 
int *got_frame, AVPac
 memset(c->prev, 0, avctx->width * avctx->height * (c->bpp / 8));
 c->decode_intra= decode_intra;
 }
-
+if (c->flags & ZMBV_KEYFRAME) {
+min_size = avctx->width * avctx->height * (c->bpp / 8);
+} else {
+min_size = (c->bx * c->by * 2 + 3) & ~3;
+}
 if (!c->decode_intra) {
 av_log(avctx, AV_LOG_ERROR, "Error! Got no format or no keyframe!\n");
 return AVERROR_INVALIDDATA;
@@ -539,6 +544,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, 
int *got_frame, AVPac
 }
 c->decomp_len = c->zstream.total_out;
 }
+if (min_size > c->decomp_len) {
+av_log(avctx, AV_LOG_ERROR, "input too small\n");
+return AVERROR_INVALIDDATA;
+}
 if (c->flags & ZMBV_KEYFRAME) {
 frame->key_frame = 1;
 frame->pict_type = AV_PICTURE_TYPE_I;
-- 
2.18.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel