[FFmpeg-devel] [PATCH] avcodec/mobiclip: Check quantizer before table setup

[Michael Niedermayer]

On Fri, Sep 11, 2020 at 10:00:02PM +0200, Paul B Mahol wrote:
> On Fri, Sep 11, 2020 at 08:09:48PM +0200, Michael Niedermayer wrote:
> > On Fri, Sep 11, 2020 at 11:12:33AM +0200, Paul B Mahol wrote:
> > > On Fri, Sep 11, 2020 at 01:19:59AM +0200, Michael Niedermayer wrote:
> > > > Fixes: index -1 out of bounds for type 'const uint8_t [6][16]'
> > > > Fixes: out of array read
> > > > Fixes: shift exponent -21 is negative
> > > > Fixes: 25422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5748258226569216
> > > > Fixes: shift exponent 8039082 is too large for 32-bit type 'int'
> > > > Fixes: 25430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5698567770210304
> > > > 
> > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > > ---
> > > >  libavcodec/mobiclip.c | 6 +++++-
> > > >  1 file changed, 5 insertions(+), 1 deletion(-)
> > > > 
> > > > diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c
> > > > index d147eddbae..13f0edc89d 100644
> > > > --- a/libavcodec/mobiclip.c
> > > > +++ b/libavcodec/mobiclip.c
> > > > @@ -1323,6 +1323,10 @@ static int mobiclip_decode(AVCodecContext *avctx, void *data,
> > > >          }
> > > >      } else {
> > > >          MotionXY *motion = s->motion;
> > > > +        int quantizer = s->quantizer + get_se_golomb(gb);
> > > > +
> > > > +        if (quantizer < 12 || quantizer > 161)
> > > 
> > > From where this numbers come?
> > 
> > It comes from the implementation
> > qtab is int and will overflow beyond 161
> 
> ok then.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Modern terrorism, a quick summary: Need oil, start war with country that
has oil, kill hundread thousand in war. Let country fall into chaos,
be surprised about raise of fundamantalists. Drop more bombs, kill more
people, be surprised about them taking revenge and drop even more bombs
and strip your own citizens of their rights and freedoms. to be continued
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20200912/39426eb2/attachment.sig>