[FFmpeg-devel] [PATCH 2/2] avcodec/av1dec: Check tile_cols

[Michael Niedermayer]

On Mon, Mar 21, 2022 at 06:03:12PM -0300, James Almer wrote:
> On 2/1/2022 3:52 PM, Michael Niedermayer wrote:
> > Fixes: division by zero
> > Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >   libavcodec/av1dec.c | 3 +++
> >   1 file changed, 3 insertions(+)
> > 
> > diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c
> > index 62d459cded..581f22a849 100644
> > --- a/libavcodec/av1dec.c
> > +++ b/libavcodec/av1dec.c
> > @@ -394,6 +394,9 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro
> >       s->tg_start = tile_group->tg_start;
> >       s->tg_end = tile_group->tg_end;
> > +    if (s->raw_frame_header->tile_cols == 0)
> 
> This should not happen. CBS should have returned an error instead or setting
> tile_cols to 0.
> The bug should probably be fixed there.

I didnt see your mail in time :(
If you want, i can revert it?

The issue seems that cbs av1 and av1dec disagree on how they handle
redundant frames.
I can "fix" it by 
--- a/libavcodec/av1dec.c
+++ b/libavcodec/av1dec.c
@@ -1066,8 +1066,8 @@ static int av1_decode_frame(AVCodecContext *avctx, void *frame,
             }
             break;
         case AV1_OBU_REDUNDANT_FRAME_HEADER:
-            if (s->raw_frame_header)
-                break;
+            // Unsupported
+            break;
         // fall-through
         case AV1_OBU_FRAME:
         case AV1_OBU_FRAME_HEADER:
         
cbs leaves tile_cols untouched (and 0) for the redundant frame
         
I didnt really look further, this probably should be looked at by someone
who knows the av1dec/cbs code better. I can provide the sample file
if someone wants to or also test any suggested fixes
         
I think this split logic where cbs and the decoder have to be kept in
sync is a bit fragile. Or at least it looks fragile

Thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you fake or manipulate statistics in a paper in physics you will never
get a job again.
If you fake or manipulate statistics in a paper in medicin you will get
a job for life at the pharma industry.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20220322/01dc3eef/attachment.sig>