[FFmpeg-devel] [PATCH 2/2] avcodec/sanm: avoid using k in left pxoff check

[Michael Niedermayer]

Hi Manuel

On Fri, May 30, 2025 at 10:54:01PM +0200, Manuel Lauss wrote:
> Hi Michael,
> 
> On Fri, May 30, 2025 at 9:52 PM Michael Niedermayer
> <michael at niedermayer.cc> wrote:
> >
> > Hi Manual
> >
> > On Wed, May 14, 2025 at 03:39:53AM +0200, Michael Niedermayer wrote:
> > > k is always 4 here and it seems this is not what was intended
> > > replacing it with 0 works but it may be wrong
> > >
> > > This needs review
> > >
> > > Fixes: out of array read
> > > Fixes: 409593384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-6488251907244032
> > >
> > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > ---
> > >  libavcodec/sanm.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > please review, this patch is just written based on gut feeling,
> > its just clear that the code before was buggy
> 
> > >
> > > diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
> > > index 00bfef00fe8..ec429e1a002 100644
> > > --- a/libavcodec/sanm.c
> > > +++ b/libavcodec/sanm.c
> > > @@ -734,7 +734,7 @@ static int old_codec4(SANMVideoContext *ctx, GetByteContext *gb, int top, int le
> > >              }
> > >
> > >              /* smooth top and left block borders with neighbours */
> > > -            if (((pxoff - p + k) < 0) || ((pxoff - p + k) >= maxpxo)
> > > +            if (((pxoff - p + 0) < 0) || ((pxoff - p + k) >= maxpxo)
> > >                  || ((pxoff + 3 * p) < 0) || ((pxoff + 3 * p) >= maxpxo)
> > >                  || (i == 0) || (j == 0))
> > >                  continue;
> 
> Oops, yes, that change is correct.

will apply


> I think you should just rip the whole block-smoothing block out
> entirely: it creates a "sawtooth" pattern
> which is more annoying than the "blockiness" it tries to soften.

probably, but i just wanted to fix the out of array access,
ill leave improvment beyond that to others

thx

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Rewriting code that is poorly written but fully understood is good.
Rewriting code that one doesnt understand is a sign that one is less smart
than the original author, trying to rewrite it will not make it better.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20250531/7d56f034/attachment.sig>