[FFmpeg-devel] [PATCH] libswresample: Prevent out of bounds.

[kobrineli at ispras.ru]

Resubmitted, thanks

On 2023-08-02 15:06, Ronald S. Bultje wrote:
> Hi,
> 
> On Wed, Aug 2, 2023 at 7:31 AM kobrineli <kobrineli at ispras.ru> wrote:
> 
>> From: Eli Kobrin <kobrineli at ispras.ru>
>> 
>> We've been fuzzing torchvision with [sydr-fuzz](
>> https://github.com/ispras/oss-sydr-fuzz)
>> and found out of bounds error in ffmpeg project at audioconvert.c:51.
>> To prevent error we need to insert corresponding check and fix checks
>> for in and out fmt in swr_init.
>> 
>> Signed-off-by: Eli Kobrin <kobrineli at ispras.ru>
>> ---
>>  libswresample/audioconvert.c | 7 ++++++-
>>  libswresample/swresample.c   | 4 ++--
>>  2 files changed, 8 insertions(+), 3 deletions(-)
>> 
>> diff --git a/libswresample/audioconvert.c 
>> b/libswresample/audioconvert.c
>> index 1d75ba1495..701f4808a0 100644
>> --- a/libswresample/audioconvert.c
>> +++ b/libswresample/audioconvert.c
>> @@ -148,7 +148,12 @@ AudioConvert *swri_audio_convert_alloc(enum
>> AVSampleFormat out_fmt,
>>                                         int flags)
>>  {
>>      AudioConvert *ctx;
>> -    conv_func_type *f =
>> fmt_pair_to_conv_functions[av_get_packed_sample_fmt(out_fmt) +
>> AV_SAMPLE_FMT_NB*av_get_packed_sample_fmt(in_fmt)];
>> +
>> +    size_t idx = av_get_packed_sample_fmt(out_fmt) + AV_SAMPLE_FMT_NB 
>> *
>> av_get_packed_sample_fmt(in_fmt);
>> +    if (idx >= AV_SAMPLE_FMT_NB * AV_SAMPLE_FMT_NB)
>> +        return NULL;
>> +
>> +    conv_func_type *f = fmt_pair_to_conv_functions[idx];
>> 
> 
> This is not necessary anymore, please remove this portion.
> 
> 
>> diff --git a/libswresample/swresample.c b/libswresample/swresample.c
>> index 6dc329a9d0..b7cab36710 100644
>> --- a/libswresample/swresample.c
>> +++ b/libswresample/swresample.c
>> @@ -196,11 +196,11 @@ av_cold int swr_init(struct SwrContext *s){
>> 
>>      clear_context(s);
>> 
>> -    if(s-> in_sample_fmt >= AV_SAMPLE_FMT_NB){
>> +    if(s-> in_sample_fmt >= AV_SAMPLE_FMT_NB || s-> in_sample_fmt < 
>> 0){
>>          av_log(s, AV_LOG_ERROR, "Requested input sample format %d is
>> invalid\n", s->in_sample_fmt);
>>          return AVERROR(EINVAL);
>>      }
>> -    if(s->out_sample_fmt >= AV_SAMPLE_FMT_NB){
>> +    if(s->out_sample_fmt >= AV_SAMPLE_FMT_NB || s->out_sample_fmt < 
>> 0){
>>          av_log(s, AV_LOG_ERROR, "Requested output sample format %d is
>> invalid\n", s->out_sample_fmt);
>>          return AVERROR(EINVAL);
>>      }
>> --
>> 2.25.1
>> 
> 
> You can simplify this to "if ((unsigned) s->in/out_sample_fmt >=
> AV_SAMPLE_FMT_NB)".
> 
> Ronald
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".