[FFmpeg-devel] [PATCH 4/5] avcodec/alac: Check for bps of 0

[Baptiste Coudurier]

Hi Paul,


> On Aug 25, 2019, at 12:37 AM, Paul B Mahol <onemda at gmail.com> wrote:
> 
> On Sun, Aug 25, 2019 at 9:33 AM Michael Niedermayer <michael at niedermayer.cc>
> wrote:
> 
>> On Fri, Aug 23, 2019 at 11:20:48AM -0300, James Almer wrote:
>>> On 8/8/2019 8:23 PM, Michael Niedermayer wrote:
>>>> Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
>>>> Fixes:
>> 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440
>>>> 
>>>> Found-by: continuous fuzzing process
>> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>>>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>>>> ---
>>>> libavcodec/alac.c | 2 +-
>>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>> 
>>>> diff --git a/libavcodec/alac.c b/libavcodec/alac.c
>>>> index 6086e2caa8..1196925aa7 100644
>>>> --- a/libavcodec/alac.c
>>>> +++ b/libavcodec/alac.c
>>>> @@ -250,7 +250,7 @@ static int decode_element(AVCodecContext *avctx,
>> AVFrame *frame, int ch_index,
>>>> 
>>>>     alac->extra_bits = get_bits(&alac->gb, 2) << 3;
>>>>     bps = alac->sample_size - alac->extra_bits + channels - 1;
>>>> -    if (bps > 32U) {
>>>> +    if (bps > 32 || bps < 1) {
>>>>         avpriv_report_missing_feature(avctx, "bps %d", bps);
>>>>         return AVERROR_PATCHWELCOME;
>>> 
>>> bps 0 (or negative) is obviously a broken file,
>> 
>> id say very likely a broken file, yes
>> 
>> 
>>> so asking for a sample
>>> is pointless. Just return invalid data in those cases, and leave this
>>> check for > 32.
>> 
>> thats a few lines more code, for an error code and different/no message
>> its a bit difficult to guess where people prefer the extra code to be
>> correct and where they prefer somewhat incorrect solutions to minimize
>> fuzzer found bugfixes.
>> 
> 
> If you dislike what people prefer when reviewing, perhaps you should stop
> sending patches :-)

This remark sounds rude and disrespectful to me.
Please refrain from making remarks like this one in the future.

— 
Baptiste