[FFmpeg-devel] [PATCH 1/3] avcodec/g2meet: Check RGB upper limit

[Michael Niedermayer]

On Sun, Apr 29, 2018 at 06:44:23PM +0200, Tomas Härdin wrote:
> sön 2018-04-29 klockan 16:41 +0200 skrev Michael Niedermayer:
> > On Fri, Apr 27, 2018 at 09:44:05PM +0200, Michael Niedermayer wrote:
> > > Fixes: runtime error: left shift of 1876744317 by 16 places cannot
> > > be represented in type 'int'
> > > Fixes: 6799/clusterfuzz-testcase-minimized-
> > > ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
> > > 
> > > Found-by: continuous fuzzing process https://github.com/google/oss-
> > > fuzz/tree/master/projects/ffmpeg
> > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > ---
> > >  libavcodec/g2meet.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
> > > index b409dae813..105a40278f 100644
> > > --- a/libavcodec/g2meet.c
> > > +++ b/libavcodec/g2meet.c
> > > @@ -556,7 +556,7 @@ static uint32_t
> > > epic_decode_pixel_pred(ePICContext *dc, int x, int y,
> > >          B     = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta);
> > >      }
> > >  
> > > -    if (R<0 || G<0 || B<0) {
> > > +    if (R<0 || G<0 || B<0 || R > 255 || G > 255 || B > 255) {
> > >          av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of
> > > range\n", R, G, B);
> > >          return 0;
> > 
> > i saw someone asked why this doesnt clip on the IRC backlog
> > 
> > There is AFAIK no public spec so theres nothing really solid to base
> > a 
> > preferrance on.
> > 
> > I favor a hard error as it is easier t debug in case it misbehaves.
> > silently cliping (if its wrong) leads to more difficult to trace
> > issues.
> > 
> > But if people prefer i can change it to clip of course.
> 
> Be as strict as possible and ask for samples if someone has a file that
> breaks these expectations
> 

ok will do

thanks

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Those who are too smart to engage in politics are punished by being
governed by those who are dumber. -- Plato 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20180516/21cedad0/attachment.sig>