[FFmpeg-devel] [PATCH 1/3] avcodec/g2meet: Check RGB upper limit

Tomas Härdin tjoppen at acc.umu.se
Sun Apr 29 19:44:23 EEST 2018


sön 2018-04-29 klockan 16:41 +0200 skrev Michael Niedermayer:
> On Fri, Apr 27, 2018 at 09:44:05PM +0200, Michael Niedermayer wrote:
> > Fixes: runtime error: left shift of 1876744317 by 16 places cannot
> > be represented in type 'int'
> > Fixes: 6799/clusterfuzz-testcase-minimized-
> > ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-
> > fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/g2meet.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
> > index b409dae813..105a40278f 100644
> > --- a/libavcodec/g2meet.c
> > +++ b/libavcodec/g2meet.c
> > @@ -556,7 +556,7 @@ static uint32_t
> > epic_decode_pixel_pred(ePICContext *dc, int x, int y,
> >          B     = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta);
> >      }
> >  
> > -    if (R<0 || G<0 || B<0) {
> > +    if (R<0 || G<0 || B<0 || R > 255 || G > 255 || B > 255) {
> >          av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of
> > range\n", R, G, B);
> >          return 0;
> 
> i saw someone asked why this doesnt clip on the IRC backlog
> 
> There is AFAIK no public spec so theres nothing really solid to base
>> preferrance on.
> 
> I favor a hard error as it is easier t debug in case it misbehaves.
> silently cliping (if its wrong) leads to more difficult to trace
> issues.
> 
> But if people prefer i can change it to clip of course.

Be as strict as possible and ask for samples if someone has a file that
breaks these expectations

/Tomas


More information about the ffmpeg-devel mailing list