[FFmpeg-devel] [PATCH 1/2] avcodec/snowdec: Check intra block dc differences.

[Carl Eugen Hoyos]

2017-11-15 21:26 GMT+01:00 Ronald S. Bultje <rsbultje at gmail.com>:
> Hi,
>
> On Wed, Nov 15, 2017 at 3:17 PM, Michael Niedermayer <michael at niedermayer.cc
>> wrote:
>
>> Fixes: Timeout
>> Fixes: 3142/clusterfuzz-testcase-5007853163118592
>>
>> Found-by: continuous fuzzing process https://github.com/google/oss-
>> fuzz/tree/master/projects/ffmpeg
>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>> ---
>>  libavcodec/snowdec.c | 19 +++++++++++++++----
>>  1 file changed, 15 insertions(+), 4 deletions(-)
>>
>> diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
>> index 727e908fb5..77ffe7f594 100644
>> --- a/libavcodec/snowdec.c
>> +++ b/libavcodec/snowdec.c
>> @@ -183,13 +183,24 @@ static int decode_q_branch(SnowContext *s, int
>> level, int x, int y){
>>          int my_context= av_log2(2*FFABS(left->my - top->my)) +
>> 0*av_log2(2*FFABS(tr->my - top->my));
>>
>>          type= get_rac(&s->c, &s->block_state[1 + left->type + top->type])
>> ? BLOCK_INTRA : 0;
>> -
>>          if(type){
>> +            int ld, cbd, crd;
>>              pred_mv(s, &mx, &my, 0, left, top, tr);
>> -            l += get_symbol(&s->c, &s->block_state[32], 1);
>> +            ld = get_symbol(&s->c, &s->block_state[32], 1);
>> +            if (ld < -255 || ld > 255) {
>> +                av_log(s->avctx, AV_LOG_DEBUG, "Invalid (Out of range)
>> intra luma block DC difference %d\n", ld);
>> +                return AVERROR_INVALIDDATA;
>> +            }
>> +            l += ld;
>>              if (s->nb_planes > 2) {
>> -                cb+= get_symbol(&s->c, &s->block_state[64], 1);
>> -                cr+= get_symbol(&s->c, &s->block_state[96], 1);
>> +                cbd = get_symbol(&s->c, &s->block_state[64], 1);
>> +                crd = get_symbol(&s->c, &s->block_state[96], 1);
>> +                if (cbd < -255 || cbd > 255 || crd < -255 || crd > 255) {
>> +                    av_log(s->avctx, AV_LOG_DEBUG, "Invalid (Out of
>> range) intra chroma block DC difference %d, %d\n", cbd, crd);
>> +                    return AVERROR_INVALIDDATA;
>> +                }
>
>
> Please remove the error messages.

How is the user supposed to know why decoding failed?
How is a developer answering on the user mailing list
supposed to know what the issue is?

(Are you planning to work on snow?)

Carl Eugen