[FFmpeg-devel] [PATCH] libavformat\svs.c: Fixed, not it is in the right place

mezhuevtp at ispras.ru mezhuevtp at ispras.ru
Mon Sep 25 14:42:54 EEST 2023


From: headshog <craaaaaachind at gmail.com>

---
 0001-Fixed-not-it-is-in-the-right-place.patch | 89 +++++++++++++++++++
 0001-Numeric-truncation-in-svs.c-57.patch     | 41 +++++++++
 libavformat/svs.c                             |  7 +-
 3 files changed, 136 insertions(+), 1 deletion(-)
 create mode 100644 0001-Fixed-not-it-is-in-the-right-place.patch
 create mode 100644 0001-Numeric-truncation-in-svs.c-57.patch

diff --git a/0001-Fixed-not-it-is-in-the-right-place.patch b/0001-Fixed-not-it-is-in-the-right-place.patch
new file mode 100644
index 0000000000..8373c56851
--- /dev/null
+++ b/0001-Fixed-not-it-is-in-the-right-place.patch
@@ -0,0 +1,89 @@
+From ea89215a6b5627f73c370381f07a87f1ccb146ea Mon Sep 17 00:00:00 2001
+From: headshog <craaaaaachind at gmail.com>
+Date: Mon, 25 Sep 2023 14:38:04 +0300
+Subject: [PATCH] Fixed, not it is in the right place.
+
+---
+ 0001-Numeric-truncation-in-svs.c-57.patch | 41 +++++++++++++++++++++++
+ libavformat/svs.c                         |  7 +++-
+ 2 files changed, 47 insertions(+), 1 deletion(-)
+ create mode 100644 0001-Numeric-truncation-in-svs.c-57.patch
+
+diff --git a/0001-Numeric-truncation-in-svs.c-57.patch b/0001-Numeric-truncation-in-svs.c-57.patch
+new file mode 100644
+index 0000000000..dbfdf07e6f
+--- /dev/null
++++ b/0001-Numeric-truncation-in-svs.c-57.patch
+@@ -0,0 +1,41 @@
++From a9b235e392024f1877d5c43fc0129e9eebb6aea2 Mon Sep 17 00:00:00 2001
++From: headshog <craaaaaachind at gmail.com>
++Date: Mon, 25 Sep 2023 12:48:22 +0300
++Subject: [PATCH] Numeric truncation in svs.c:57
++
++Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
++In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
++Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
++In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
++---
++ libavformat/svs.c | 7 ++++++-
++ 1 file changed, 6 insertions(+), 1 deletion(-)
++
++diff --git a/libavformat/svs.c b/libavformat/svs.c
++index b91d29f5a6..54f24f539c 100644
++--- a/libavformat/svs.c
+++++ b/libavformat/svs.c
++@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
++ {
++     AVStream *st;
++     uint32_t pitch;
+++    int64_t rescale_val;
+++
+++    rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+++    if (rescale_val > INT_MAX)
+++        return AVERROR(ERANGE);
++ 
++     st = avformat_new_stream(s, NULL);
++     if (!st)
++@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
++     st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
++     st->codecpar->codec_id       = AV_CODEC_ID_ADPCM_PSX;
++     st->codecpar->ch_layout      = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
++-    st->codecpar->sample_rate    = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+++    st->codecpar->sample_rate    = rescale_val;
++     st->codecpar->block_align    = 32;
++     st->start_time               = 0;
++     if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
++-- 
++2.25.1
++
+diff --git a/libavformat/svs.c b/libavformat/svs.c
+index b91d29f5a6..bdfb856184 100644
+--- a/libavformat/svs.c
++++ b/libavformat/svs.c
+@@ -42,6 +42,7 @@ static int svs_read_header(AVFormatContext *s)
+ {
+     AVStream *st;
+     uint32_t pitch;
++    int64_t rescale_val;
+ 
+     st = avformat_new_stream(s, NULL);
+     if (!st)
+@@ -51,10 +52,14 @@ static int svs_read_header(AVFormatContext *s)
+     pitch = avio_rl32(s->pb);
+     avio_skip(s->pb, 12);
+ 
++    rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++    if (rescale_val > INT_MAX)
++        return AVERROR(ERANGE);
++
+     st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
+     st->codecpar->codec_id       = AV_CODEC_ID_ADPCM_PSX;
+     st->codecpar->ch_layout      = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
+-    st->codecpar->sample_rate    = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++    st->codecpar->sample_rate    = rescale_val;
+     st->codecpar->block_align    = 32;
+     st->start_time               = 0;
+     if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
+-- 
+2.25.1
+
diff --git a/0001-Numeric-truncation-in-svs.c-57.patch b/0001-Numeric-truncation-in-svs.c-57.patch
new file mode 100644
index 0000000000..dbfdf07e6f
--- /dev/null
+++ b/0001-Numeric-truncation-in-svs.c-57.patch
@@ -0,0 +1,41 @@
+From a9b235e392024f1877d5c43fc0129e9eebb6aea2 Mon Sep 17 00:00:00 2001
+From: headshog <craaaaaachind at gmail.com>
+Date: Mon, 25 Sep 2023 12:48:22 +0300
+Subject: [PATCH] Numeric truncation in svs.c:57
+
+Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
+In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
+Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
+In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
+---
+ libavformat/svs.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/libavformat/svs.c b/libavformat/svs.c
+index b91d29f5a6..54f24f539c 100644
+--- a/libavformat/svs.c
++++ b/libavformat/svs.c
+@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
+ {
+     AVStream *st;
+     uint32_t pitch;
++    int64_t rescale_val;
++
++    rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++    if (rescale_val > INT_MAX)
++        return AVERROR(ERANGE);
+ 
+     st = avformat_new_stream(s, NULL);
+     if (!st)
+@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
+     st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
+     st->codecpar->codec_id       = AV_CODEC_ID_ADPCM_PSX;
+     st->codecpar->ch_layout      = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
+-    st->codecpar->sample_rate    = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++    st->codecpar->sample_rate    = rescale_val;
+     st->codecpar->block_align    = 32;
+     st->start_time               = 0;
+     if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
+-- 
+2.25.1
+
diff --git a/libavformat/svs.c b/libavformat/svs.c
index b91d29f5a6..bdfb856184 100644
--- a/libavformat/svs.c
+++ b/libavformat/svs.c
@@ -42,6 +42,7 @@ static int svs_read_header(AVFormatContext *s)
 {
     AVStream *st;
     uint32_t pitch;
+    int64_t rescale_val;
 
     st = avformat_new_stream(s, NULL);
     if (!st)
@@ -51,10 +52,14 @@ static int svs_read_header(AVFormatContext *s)
     pitch = avio_rl32(s->pb);
     avio_skip(s->pb, 12);
 
+    rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+    if (rescale_val > INT_MAX)
+        return AVERROR(ERANGE);
+
     st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
     st->codecpar->codec_id       = AV_CODEC_ID_ADPCM_PSX;
     st->codecpar->ch_layout      = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
-    st->codecpar->sample_rate    = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+    st->codecpar->sample_rate    = rescale_val;
     st->codecpar->block_align    = 32;
     st->start_time               = 0;
     if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
-- 
2.25.1



More information about the ffmpeg-devel mailing list