[FFmpeg-devel] [PATCH 2/2] avcodec/siren: Check available bits at frame start

[Peter Ross]

On Tue, Sep 28, 2021 at 12:07:49AM -0300, James Almer wrote:
> On 9/27/2021 7:37 PM, Michael Niedermayer wrote:
> > Fixes: Timeout
> > Fixes: 39089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSNSIREN_fuzzer-6677219854909440
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >   libavcodec/siren.c | 3 +++
> >   1 file changed, 3 insertions(+)
> > 
> > diff --git a/libavcodec/siren.c b/libavcodec/siren.c
> > index 7f2b4678608..708990d6654 100644
> > --- a/libavcodec/siren.c
> > +++ b/libavcodec/siren.c
> > @@ -718,6 +718,9 @@ static int siren_decode(AVCodecContext *avctx, void *data,
> >       if ((ret = init_get_bits8(gb, avpkt->data, avpkt->size)) < 0)
> >           return ret;
> > +    if (s->sample_rate_bits + 4 > get_bits_left(gb))
> > +        return AVERROR_INVALIDDATA;
> 
> This is not enough. You'll inevitably get another timeout in the future
> unless you add a get_bits_left(gb) > 0 condition to the loop in
> decode_envelope().
> And there should be at least four bits left after decode_envelope() returns,
> so check for that too.

suggest increasing the threshold to include:

    s->sample_rate_bits + s->number_of_regions + 4 + s->checksum_bits > get_bits_left(gb)


hey michael are you only fuzzing AV_CODEC_ID_MSNSIREN?
i would expect this issue to occur for for the vanilla SIREN codec too?


-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20210928/eee39976/attachment.sig>