[FFmpeg-devel] [PATCH] avcodec/cfhd: Check transform type

[Paul B Mahol]

On 8/28/20, Michael Niedermayer <michael at niedermayer.cc> wrote:
> On Fri, Aug 28, 2020 at 10:24:04PM +0200, Paul B Mahol wrote:
>> On 8/28/20, Michael Niedermayer <michael at niedermayer.cc> wrote:
>> > On Fri, Aug 28, 2020 at 01:31:38AM +0200, Paul B Mahol wrote:
>> >> On 8/28/20, Michael Niedermayer <michael at niedermayer.cc> wrote:
>> >> > Fixes: out of array access
>> >> > Fixes:
>> >> > 24823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4855119863349248
>> >> >
>> >> > Found-by: continuous fuzzing process
>> >> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>> >> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>> >> > ---
>> >> >  libavcodec/cfhd.c | 2 +-
>> >> >  1 file changed, 1 insertion(+), 1 deletion(-)
>> >> >
>> >>
>> >> It is not invalid, but unsupported.
>> >
>> > fixed error code and message locally
>> >
>> > Is there some specification for this ?
>> > i was looking yesterday but google failed to point me to one
>> >
>>
>> No specifications, just SDK on github.
>>
>> Also I'm unsure if that is sufficient fix for the underline issue.
>
> I suspect the decoder has more issues. I was hoping that there is a
> specification that i could base validity and tag ordering checks on.
>

Look at encoder, it follows tag order, note that some tags are purely optional.

>
> Thanks
>
> [...]
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> Many things microsoft did are stupid, but not doing something just because
> microsoft did it is even more stupid. If everything ms did were stupid they
> would be bankrupt already.
>