[FFmpeg-devel] [PATCH 1/7] avcodec/utils: apply the same alignment to YUV410 as we do to YUV420 when motion estimation is used

[Andreas Rheinhardt]

Michael Niedermayer:
> The snow encoder uses block based motion estimation which can read out of array if
> insufficient alignment is used
> 
> Fixes: out of array access
> Fixes: 68963/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4979988435632128
> Fixes: 68969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6239933667803136.fuzz
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/utils.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> index 337c00e789a..7914f799041 100644
> --- a/libavcodec/utils.c
> +++ b/libavcodec/utils.c
> @@ -259,6 +259,9 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
>          if (s->codec_id == AV_CODEC_ID_SVQ1) {
>              w_align = 64;
>              h_align = 64;
> +        } else if (s->codec_id == AV_CODEC_ID_SNOW) {
> +            w_align = 16;
> +            h_align = 16;
>          }
>          break;
>      case AV_PIX_FMT_RGB555:

avcodec_align_dimensions2() is for decoders and happens to be used by
ff_encode_alloc_frame(), too. But decoders should not be required to add
more padding because the decoder needs more. Instead the encoder should
add more padding itself (by using more than 2 * EDGE_WIDTH).

- Andreas