[FFmpeg-cvslog] [ffmpeg] branch master updated. 373bd80b16 avcodec/dxv: Use av_fast_realloc() for op_data
ffmpeg-git at ffmpeg.org
ffmpeg-git at ffmpeg.org
Wed Aug 13 13:20:08 EEST 2025
The branch, master has been updated
via 373bd80b16643e349d229e2479fad565dba129a5 (commit)
via 4e5f25c0a50ac17e20ddc3549dbff0976a5826b9 (commit)
via 6a8c41dcacbba011e553fbf35518577321d1aadb (commit)
via 4a0b793737ec1a118d2119a677fa17926def01bc (commit)
via d5bdb0b705ce96739e812ca5317361674359369c (commit)
from 870cfed2317e311a71bc14773332486a162f059c (commit)
- Log -----------------------------------------------------------------
commit 373bd80b16643e349d229e2479fad565dba129a5
Author: Michael Niedermayer <michael at niedermayer.cc>
AuthorDate: Fri Aug 8 12:43:46 2025 +0200
Commit: michaelni <michael at niedermayer.cc>
CommitDate: Wed Aug 13 10:12:07 2025 +0000
avcodec/dxv: Use av_fast_realloc() for op_data
makes things consistent
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 052fe0ac6c..dd82e450b1 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -46,6 +46,7 @@ typedef struct DXVContext {
int64_t ctex_size; // Chroma texture size
uint8_t *op_data[4]; // Opcodes
+ unsigned op_data_size[4];
int64_t op_size[4]; // Opcodes size
} DXVContext;
@@ -1003,9 +1004,11 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
memset(ctx->ctex_data + old_size, 0, ctx->ctex_data_size - old_size);
for (i = 0; i < 4; i++) {
- ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]);
- if (ret < 0)
- return ret;
+ old_size = ctx->op_data_size[i];
+ ptr = av_fast_realloc(ctx->op_data[i], &ctx->op_data_size[i], ctx->op_size[i]);
+ if (!ptr)
+ return AVERROR(ENOMEM);
+ ctx->op_data[i] = ptr;
}
}
@@ -1101,6 +1104,7 @@ static av_cold int dxv_close(AVCodecContext *avctx)
av_freep(&ctx->op_data[1]);
av_freep(&ctx->op_data[2]);
av_freep(&ctx->op_data[3]);
+ memset(ctx->op_data_size, 0, sizeof(ctx->op_data_size));
return 0;
}
commit 4e5f25c0a50ac17e20ddc3549dbff0976a5826b9
Author: Michael Niedermayer <michael at niedermayer.cc>
AuthorDate: Fri Aug 8 12:25:55 2025 +0200
Commit: michaelni <michael at niedermayer.cc>
CommitDate: Wed Aug 13 10:12:07 2025 +0000
avcodec/dxv: Clear ctex
same issue as with tex
Fixes: 431665305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5339599339847680
Fixes: use of uninitialized memory
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 9bef92d7b2..052fe0ac6c 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -40,6 +40,7 @@ typedef struct DXVContext {
uint8_t *tex_data; // Compressed texture
unsigned tex_data_size;
uint8_t *ctex_data; // Compressed chroma texture
+ unsigned ctex_data_size;
int64_t tex_size; // Texture size
int64_t ctex_size; // Chroma texture size
@@ -993,9 +994,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
ctx->op_size[2] = avctx->coded_width * avctx->coded_height / 32;
ctx->op_size[3] = avctx->coded_width * avctx->coded_height / 16;
- ret = av_reallocp(&ctx->ctex_data, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE);
- if (ret < 0)
- return ret;
+ old_size = ctx->ctex_data_size;
+ ptr = av_fast_realloc(ctx->ctex_data, &ctx->ctex_data_size, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE);
+ if (!ptr)
+ return AVERROR(ENOMEM);
+ ctx->ctex_data = ptr;
+ if (old_size < ctx->ctex_data_size)
+ memset(ctx->ctex_data + old_size, 0, ctx->ctex_data_size - old_size);
+
for (i = 0; i < 4; i++) {
ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]);
if (ret < 0)
@@ -1089,6 +1095,8 @@ static av_cold int dxv_close(AVCodecContext *avctx)
ctx->tex_data_size = 0;
av_freep(&ctx->ctex_data);
+ ctx->ctex_data_size = 0;
+
av_freep(&ctx->op_data[0]);
av_freep(&ctx->op_data[1]);
av_freep(&ctx->op_data[2]);
commit 6a8c41dcacbba011e553fbf35518577321d1aadb
Author: Michael Niedermayer <michael at niedermayer.cc>
AuthorDate: Fri Aug 8 12:25:55 2025 +0200
Commit: michaelni <michael at niedermayer.cc>
CommitDate: Wed Aug 13 10:12:07 2025 +0000
avcodec/dxv: Check that we initialize op_data
Fixes: 431665305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5339599339847680
Fixes: use of uninitialized memory
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 7e11bef733..9bef92d7b2 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -275,7 +275,9 @@ static int dxv_decompress_opcodes(GetByteContext *gb, void *dstp, size_t op_size
if ((flag & 3) == 0) {
bytestream2_skip(gb, 1);
- bytestream2_get_buffer(gb, dstp, op_size);
+ int read_size = bytestream2_get_buffer(gb, dstp, op_size);
+ if (read_size != op_size)
+ return AVERROR_INVALIDDATA;
} else if ((flag & 3) == 1) {
bytestream2_skip(gb, 1);
memset(dstp, bytestream2_get_byte(gb), op_size);
commit 4a0b793737ec1a118d2119a677fa17926def01bc
Author: Michael Niedermayer <michael at niedermayer.cc>
AuthorDate: Thu Aug 7 19:56:53 2025 +0200
Commit: michaelni <michael at niedermayer.cc>
CommitDate: Wed Aug 13 10:12:07 2025 +0000
avcodec/dxv: Use av_fast_realloc() and clear all new space
The code writing in the buffer has a wide range of error checks
which simply leave it partly uninitialized.
Initializing it on allocation ensures no sensitive data leaks and that
bugs are more reliably reproduceable
Fixes: use of uninitialized memory
Fixes: 435225510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-4521918634196992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 0b8e077ad6..7e11bef733 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -38,6 +38,7 @@ typedef struct DXVContext {
GetByteContext gbc;
uint8_t *tex_data; // Compressed texture
+ unsigned tex_data_size;
uint8_t *ctex_data; // Compressed chroma texture
int64_t tex_size; // Texture size
@@ -969,9 +970,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
ctx->tex_size = avctx->coded_width / (texdsp_ctx.raw_ratio / (avctx->pix_fmt == AV_PIX_FMT_RGBA ? 4 : 1)) *
avctx->coded_height / TEXTURE_BLOCK_H *
texdsp_ctx.tex_ratio;
- ret = av_reallocp(&ctx->tex_data, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE);
- if (ret < 0)
- return ret;
+ unsigned old_size = ctx->tex_data_size;
+ void *ptr = av_fast_realloc(ctx->tex_data, &ctx->tex_data_size, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE);
+ if (!ptr)
+ return AVERROR(ENOMEM);
+ ctx->tex_data = ptr;
+
+ if (ctx->tex_data_size > old_size)
+ memset(ctx->tex_data + old_size, 0, ctx->tex_data_size - old_size);
if (avctx->pix_fmt != AV_PIX_FMT_RGBA) {
int i;
@@ -1078,6 +1084,8 @@ static av_cold int dxv_close(AVCodecContext *avctx)
DXVContext *ctx = avctx->priv_data;
av_freep(&ctx->tex_data);
+ ctx->tex_data_size = 0;
+
av_freep(&ctx->ctex_data);
av_freep(&ctx->op_data[0]);
av_freep(&ctx->op_data[1]);
commit d5bdb0b705ce96739e812ca5317361674359369c
Author: Michael Niedermayer <michael at niedermayer.cc>
AuthorDate: Thu Aug 7 19:38:30 2025 +0200
Commit: michaelni <michael at niedermayer.cc>
CommitDate: Wed Aug 13 10:12:07 2025 +0000
avcodec/sanm: Check mv in codec48_block()
Fixes: out of array read
Fixes: 436943287/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5011037029203968
This issue did oddly enough, not replicate
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index d345f58846..a066a864eb 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -1427,8 +1427,18 @@ static void c48_4to8(uint8_t *dst, const uint8_t *src, const uint16_t w)
}
}
-static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
- const uint16_t w)
+static int check_mv(int x, int y, const uint16_t w, int h, int blocksize, int mvofs) {
+ if (mvofs < -x + -y*w)
+ return AVERROR_INVALIDDATA;
+
+ if (mvofs > w-x-blocksize + w*(h-y-blocksize))
+ return AVERROR_INVALIDDATA;
+
+ return 0;
+}
+
+static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, int x, int y,
+ const uint16_t w, int h)
{
uint8_t opc, sb[16];
int i, j, k, l;
@@ -1453,6 +1463,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
if (bytestream2_get_bytes_left(&ctx->gb) < 2)
return 1;
mvofs = bytestream2_get_le16(&ctx->gb);
+ if (check_mv(x, y, w, h, 8, mvofs))
+ return 1;
for (i = 0; i < 8; i++) {
ofs = w * i;
for (k = 0; k < 8; k++)
@@ -1480,6 +1492,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
for (k = 0; k < 8; k += 4) {
opc = bytestream2_get_byteu(&ctx->gb);
mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w);
+ if (check_mv(x+k, y+i, w, h, 4, mvofs))
+ return 1;
for (j = 0; j < 4; j++) {
ofs = (w * (j + i)) + k;
for (l = 0; l < 4; l++)
@@ -1494,6 +1508,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
for (i = 0; i < 8; i += 4) {
for (k = 0; k < 8; k += 4) {
mvofs = bytestream2_get_le16(&ctx->gb);
+ if (check_mv(x+k, y+i, w, h, 4, mvofs))
+ return 1;
for (j = 0; j < 4; j++) {
ofs = (w * (j + i)) + k;
for (l = 0; l < 4; l++)
@@ -1516,6 +1532,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
ofs = (w * i) + j;
opc = bytestream2_get_byteu(&ctx->gb);
mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w);
+ if (check_mv(x+j, y+i, w, h, 2, mvofs))
+ return 1;
for (l = 0; l < 2; l++) {
*(dst + ofs + l + 0) = *(db + ofs + l + 0 + mvofs);
*(dst + ofs + l + w) = *(db + ofs + l + w + mvofs);
@@ -1530,6 +1548,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
for (j = 0; j < 8; j += 2) {
ofs = w * i + j;
mvofs = bytestream2_get_le16(&ctx->gb);
+ if (check_mv(x+j, y+i, w, h, 2, mvofs))
+ return 1;
for (l = 0; l < 2; l++) {
*(dst + ofs + l + 0) = *(db + ofs + l + 0 + mvofs);
*(dst + ofs + l + w) = *(db + ofs + l + w + mvofs);
@@ -1548,6 +1568,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db,
break;
default: // copy 8x8 block from prev, c37_mv from source
mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w);
+ if (check_mv(x, y, w, h, 8, mvofs))
+ return 1;
for (i = 0; i < 8; i++) {
ofs = i * w;
for (l = 0; l < 8; l++)
@@ -1613,7 +1635,7 @@ static int old_codec48(SANMVideoContext *ctx, int width, int height)
if (seq == ctx->prev_seq + 1) {
for (j = 0; j < height; j += 8) {
for (i = 0; i < width; i += 8) {
- if (codec48_block(ctx, dst + i, prev + i, width))
+ if (codec48_block(ctx, dst + i, prev + i, i, j, width, height))
return AVERROR_INVALIDDATA;
}
dst += width * 8;
-----------------------------------------------------------------------
Summary of changes:
libavcodec/dxv.c | 42 ++++++++++++++++++++++++++++++++----------
libavcodec/sanm.c | 28 +++++++++++++++++++++++++---
2 files changed, 57 insertions(+), 13 deletions(-)
hooks/post-receive
--
More information about the ffmpeg-cvslog
mailing list