[FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top

[Michael Niedermayer]

On Fri, Aug 01, 2025 at 02:50:56PM +0200, Manuel Lauss wrote:
> On Fri, Aug 1, 2025 at 12:48 AM Michael Niedermayer
> <michael at niedermayer.cc> wrote:
> >
> > Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
> > Fixes: out of array access
> >
> > CC: Manuel Lauss <manuel.lauss at gmail.com>
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/sanm.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
> > index 617b977ab70..d345f588463 100644
> > --- a/libavcodec/sanm.c
> > +++ b/libavcodec/sanm.c
> > @@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> >      bytestream2_skip(gb, 2);
> >      parm2 = bytestream2_get_le16u(gb);
> >
> > -    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
> > +    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {
> 
> OK, makes sense.
> 
> >          av_log(ctx->avctx, AV_LOG_WARNING,
> >                 "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
> >                 codec, w, h, left, top);
> > @@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> >              }
> >          }
> >      } else {
> > -        if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) {
> > +        if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) {
> 
> OK, does not break anything.
> 
> >              /* correct unexpected overly large frames: this happens
> >               * for instance with The Dig's sq1.san video: it has a few
> >               * (all black) 640x480 frames halfway in, while the rest is
> > @@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
> >      if ((w == ctx->width) && (h == ctx->height)) {
> >          memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size);
> >      } else {
> > -        uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
> >          const uint8_t *src = (uint8_t *)ctx->frm0;
> >          const int cw = FFMIN(w, ctx->width - left);
> >          const int ch = FFMIN(h, ctx->height - top);
> >          if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) {
> > +            uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
> 
> OK
> 
> >              for (int i = 0; i < ch; i++) {
> >                  memcpy(dst, src, cw);
> >                  dst += ctx->pitch;
> 
> 
> Reviewed-by: Manuel Lauss <manuel.lauss at gmail.com>

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

"Nothing to hide" only works if the folks in power share the values of
you and everyone you know entirely and always will -- Tom Scott

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20250801/89eebb6a/attachment.sig>