[FFmpeg-devel] [PATCH] libavformat\svs.c: Fixed, not it is in the right place
mezhuevtp at ispras.ru
mezhuevtp at ispras.ru
Mon Sep 25 14:42:54 EEST 2023
From: headshog <craaaaaachind at gmail.com>
---
0001-Fixed-not-it-is-in-the-right-place.patch | 89 +++++++++++++++++++
0001-Numeric-truncation-in-svs.c-57.patch | 41 +++++++++
libavformat/svs.c | 7 +-
3 files changed, 136 insertions(+), 1 deletion(-)
create mode 100644 0001-Fixed-not-it-is-in-the-right-place.patch
create mode 100644 0001-Numeric-truncation-in-svs.c-57.patch
diff --git a/0001-Fixed-not-it-is-in-the-right-place.patch b/0001-Fixed-not-it-is-in-the-right-place.patch
new file mode 100644
index 0000000000..8373c56851
--- /dev/null
+++ b/0001-Fixed-not-it-is-in-the-right-place.patch
@@ -0,0 +1,89 @@
+From ea89215a6b5627f73c370381f07a87f1ccb146ea Mon Sep 17 00:00:00 2001
+From: headshog <craaaaaachind at gmail.com>
+Date: Mon, 25 Sep 2023 14:38:04 +0300
+Subject: [PATCH] Fixed, not it is in the right place.
+
+---
+ 0001-Numeric-truncation-in-svs.c-57.patch | 41 +++++++++++++++++++++++
+ libavformat/svs.c | 7 +++-
+ 2 files changed, 47 insertions(+), 1 deletion(-)
+ create mode 100644 0001-Numeric-truncation-in-svs.c-57.patch
+
+diff --git a/0001-Numeric-truncation-in-svs.c-57.patch b/0001-Numeric-truncation-in-svs.c-57.patch
+new file mode 100644
+index 0000000000..dbfdf07e6f
+--- /dev/null
++++ b/0001-Numeric-truncation-in-svs.c-57.patch
+@@ -0,0 +1,41 @@
++From a9b235e392024f1877d5c43fc0129e9eebb6aea2 Mon Sep 17 00:00:00 2001
++From: headshog <craaaaaachind at gmail.com>
++Date: Mon, 25 Sep 2023 12:48:22 +0300
++Subject: [PATCH] Numeric truncation in svs.c:57
++
++Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
++In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
++Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
++In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
++---
++ libavformat/svs.c | 7 ++++++-
++ 1 file changed, 6 insertions(+), 1 deletion(-)
++
++diff --git a/libavformat/svs.c b/libavformat/svs.c
++index b91d29f5a6..54f24f539c 100644
++--- a/libavformat/svs.c
+++++ b/libavformat/svs.c
++@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
++ {
++ AVStream *st;
++ uint32_t pitch;
+++ int64_t rescale_val;
+++
+++ rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+++ if (rescale_val > INT_MAX)
+++ return AVERROR(ERANGE);
++
++ st = avformat_new_stream(s, NULL);
++ if (!st)
++@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
++ st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
++ st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX;
++ st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
++- st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+++ st->codecpar->sample_rate = rescale_val;
++ st->codecpar->block_align = 32;
++ st->start_time = 0;
++ if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
++--
++2.25.1
++
+diff --git a/libavformat/svs.c b/libavformat/svs.c
+index b91d29f5a6..bdfb856184 100644
+--- a/libavformat/svs.c
++++ b/libavformat/svs.c
+@@ -42,6 +42,7 @@ static int svs_read_header(AVFormatContext *s)
+ {
+ AVStream *st;
+ uint32_t pitch;
++ int64_t rescale_val;
+
+ st = avformat_new_stream(s, NULL);
+ if (!st)
+@@ -51,10 +52,14 @@ static int svs_read_header(AVFormatContext *s)
+ pitch = avio_rl32(s->pb);
+ avio_skip(s->pb, 12);
+
++ rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++ if (rescale_val > INT_MAX)
++ return AVERROR(ERANGE);
++
+ st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
+ st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX;
+ st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
+- st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++ st->codecpar->sample_rate = rescale_val;
+ st->codecpar->block_align = 32;
+ st->start_time = 0;
+ if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
+--
+2.25.1
+
diff --git a/0001-Numeric-truncation-in-svs.c-57.patch b/0001-Numeric-truncation-in-svs.c-57.patch
new file mode 100644
index 0000000000..dbfdf07e6f
--- /dev/null
+++ b/0001-Numeric-truncation-in-svs.c-57.patch
@@ -0,0 +1,41 @@
+From a9b235e392024f1877d5c43fc0129e9eebb6aea2 Mon Sep 17 00:00:00 2001
+From: headshog <craaaaaachind at gmail.com>
+Date: Mon, 25 Sep 2023 12:48:22 +0300
+Subject: [PATCH] Numeric truncation in svs.c:57
+
+Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
+In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
+Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
+In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
+---
+ libavformat/svs.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/libavformat/svs.c b/libavformat/svs.c
+index b91d29f5a6..54f24f539c 100644
+--- a/libavformat/svs.c
++++ b/libavformat/svs.c
+@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
+ {
+ AVStream *st;
+ uint32_t pitch;
++ int64_t rescale_val;
++
++ rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++ if (rescale_val > INT_MAX)
++ return AVERROR(ERANGE);
+
+ st = avformat_new_stream(s, NULL);
+ if (!st)
+@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
+ st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
+ st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX;
+ st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
+- st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
++ st->codecpar->sample_rate = rescale_val;
+ st->codecpar->block_align = 32;
+ st->start_time = 0;
+ if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
+--
+2.25.1
+
diff --git a/libavformat/svs.c b/libavformat/svs.c
index b91d29f5a6..bdfb856184 100644
--- a/libavformat/svs.c
+++ b/libavformat/svs.c
@@ -42,6 +42,7 @@ static int svs_read_header(AVFormatContext *s)
{
AVStream *st;
uint32_t pitch;
+ int64_t rescale_val;
st = avformat_new_stream(s, NULL);
if (!st)
@@ -51,10 +52,14 @@ static int svs_read_header(AVFormatContext *s)
pitch = avio_rl32(s->pb);
avio_skip(s->pb, 12);
+ rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+ if (rescale_val > INT_MAX)
+ return AVERROR(ERANGE);
+
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX;
st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
- st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+ st->codecpar->sample_rate = rescale_val;
st->codecpar->block_align = 32;
st->start_time = 0;
if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
--
2.25.1
More information about the ffmpeg-devel
mailing list