[FFmpeg-devel] [PATCH 2/2] avcodec/wavpack: Prevent frame format from being wrong

[Michael Niedermayer]

On Mon, Mar 23, 2020 at 05:08:23PM -0700, David Bryant wrote:
> On 3/23/20 9:49 AM, Anton Khirnov wrote:
> > Quoting Michael Niedermayer (2020-03-20 21:50:18)
> >> On Fri, Mar 20, 2020 at 10:18:49AM +0100, Anton Khirnov wrote:
> >>> Quoting Michael Niedermayer (2020-03-20 01:03:36)
> >>>> Fixes: out of array access
> >>>> Fixes: 21193/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5125168956702720
> >>>>
> >>>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> >>>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> >>>> ---
> >>>>  libavcodec/wavpack.c | 1 +
> >>>>  1 file changed, 1 insertion(+)
> >>>>
> >>>> diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c
> >>>> index b27262b94e..e9c870e41e 100644
> >>>> --- a/libavcodec/wavpack.c
> >>>> +++ b/libavcodec/wavpack.c
> >>>> @@ -1488,6 +1488,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
> >>>>  
> >>>>          /* get output buffer */
> >>>>          wc->curr_frame.f->nb_samples = s->samples;
> >>>> +        wc->curr_frame.f->format     = avctx->sample_fmt;
> >>> How does this have any effect? curr_frame.f should now be clean and get
> >>> initialized from avctx->sample_fmt.
> >> IIRC
> >> The format changes between frames, so the struct is still set to the one
> >> from the previous frame and that overrides the use of the avctx value
> >>
> >> setting it to NONE (here or somewhere else) should work too.
> > ff_thread_release_buffer() is called on that frame immediately before,
> > which should reset it to defaults (setting format to FMT_NONE).
> >
> I don't think the format should change between frames, so I don't understand how the format is getting set to a wacky value.

wavpack_decode_frame() sets the format from flags read for each frame. 


> 
> Would it be possible for me the get the triggering test case and try this myself? I searched and couldn't find it, so I assume
> it's not public yet. I assume that just decoding the file should trigger the assertion, right?

sample sent privatly

thanks

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The real ebay dictionary, page 1
"Used only once"    - "Some unspecified defect prevented a second use"
"In good condition" - "Can be repaird by experienced expert"
"As is" - "You wouldnt want it even if you were payed for it, if you knew ..."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20200324/217cad22/attachment.sig>