[FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top

[Manuel Lauss]

On Fri, Aug 1, 2025 at 12:48 AM Michael Niedermayer
<michael at niedermayer.cc> wrote:
>
> Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
> Fixes: out of array access
>
> CC: Manuel Lauss <manuel.lauss at gmail.com>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/sanm.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
> index 617b977ab70..d345f588463 100644
> --- a/libavcodec/sanm.c
> +++ b/libavcodec/sanm.c
> @@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
>      bytestream2_skip(gb, 2);
>      parm2 = bytestream2_get_le16u(gb);
>
> -    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
> +    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {

OK, makes sense.

>          av_log(ctx->avctx, AV_LOG_WARNING,
>                 "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
>                 codec, w, h, left, top);
> @@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
>              }
>          }
>      } else {
> -        if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) {
> +        if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) {

OK, does not break anything.

>              /* correct unexpected overly large frames: this happens
>               * for instance with The Dig's sq1.san video: it has a few
>               * (all black) 640x480 frames halfway in, while the rest is
> @@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
>      if ((w == ctx->width) && (h == ctx->height)) {
>          memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size);
>      } else {
> -        uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
>          const uint8_t *src = (uint8_t *)ctx->frm0;
>          const int cw = FFMIN(w, ctx->width - left);
>          const int ch = FFMIN(h, ctx->height - top);
>          if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) {
> +            uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;

OK

>              for (int i = 0; i < ch; i++) {
>                  memcpy(dst, src, cw);
>                  dst += ctx->pitch;


Reviewed-by: Manuel Lauss <manuel.lauss at gmail.com>

Thanks!
     Manuel