[FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top

[Michael Niedermayer]

Hi

send this to ML, because of ease of "CC:"

On Fri, Aug 01, 2025 at 12:48:32AM +0200, Michael Niedermayer wrote:
> Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
> Fixes: out of array access
> 
> CC: Manuel Lauss <manuel.lauss at gmail.com>

manuel, please review / check if this is ok with existing sanm files


> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/sanm.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
> index 617b977ab70..d345f588463 100644
> --- a/libavcodec/sanm.c
> +++ b/libavcodec/sanm.c
> @@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
>      bytestream2_skip(gb, 2);
>      parm2 = bytestream2_get_le16u(gb);
>  
> -    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
> +    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {
>          av_log(ctx->avctx, AV_LOG_WARNING,
>                 "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
>                 codec, w, h, left, top);
> @@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
>              }
>          }
>      } else {
> -        if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) {
> +        if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) {
>              /* correct unexpected overly large frames: this happens
>               * for instance with The Dig's sq1.san video: it has a few
>               * (all black) 640x480 frames halfway in, while the rest is
> @@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
>      if ((w == ctx->width) && (h == ctx->height)) {
>          memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size);
>      } else {
> -        uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
>          const uint8_t *src = (uint8_t *)ctx->frm0;
>          const int cw = FFMIN(w, ctx->width - left);
>          const int ch = FFMIN(h, ctx->height - top);
>          if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) {
> +            uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
>              for (int i = 0; i < ch; i++) {
>                  memcpy(dst, src, cw);
>                  dst += ctx->pitch;
> -- 
> 2.50.1
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
> 

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Dictatorship naturally arises out of democracy, and the most aggravated
form of tyranny and slavery out of the most extreme liberty. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20250801/8151e2f8/attachment.sig>