[FFmpeg-devel] [PATCH 1/5] avcodec/atrac9dec: Clamp band_ext_data to max that can be read if skipped.

[James Almer]

On 12/26/2019 1:24 PM, Lynne wrote:
> Dec 26, 2019, 13:57 by dev at lynne.ee:
> 
>> Dec 16, 2019, 23:19 by michael at niedermayer.cc:
>>
>>> Fixes: out of array read
>>> Fixes: 19327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5679823087468544
>>>
>>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc> 
>>>
> 
> Actually nevermind, patch is good as-is. I think a 0 len just means to reuse the parameters from the previous. So clipping them should be fine.
> You should replace the FFMIN(val, (len << 1) - 1) with a av_clip_uintp2(val, len) which does exactly that.

I guess he didn't use it because c->band_ext_data is an int array. A
quick look at the code shows it apparently can't be negative, so
av_clip_uintp2() should be safe, but maybe the type should be changed to
unsigned to avoid confusion.

> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>