Hi, On Wed, Aug 2, 2023 at 7:31 AM kobrineli <kobrin...@ispras.ru> wrote:
> From: Eli Kobrin <kobrin...@ispras.ru> > > We've been fuzzing torchvision with [sydr-fuzz]( > https://github.com/ispras/oss-sydr-fuzz) > and found out of bounds error in ffmpeg project at audioconvert.c:51. > To prevent error we need to insert corresponding check and fix checks > for in and out fmt in swr_init. > > Signed-off-by: Eli Kobrin <kobrin...@ispras.ru> > --- > libswresample/audioconvert.c | 7 ++++++- > libswresample/swresample.c | 4 ++-- > 2 files changed, 8 insertions(+), 3 deletions(-) > > diff --git a/libswresample/audioconvert.c b/libswresample/audioconvert.c > index 1d75ba1495..701f4808a0 100644 > --- a/libswresample/audioconvert.c > +++ b/libswresample/audioconvert.c > @@ -148,7 +148,12 @@ AudioConvert *swri_audio_convert_alloc(enum > AVSampleFormat out_fmt, > int flags) > { > AudioConvert *ctx; > - conv_func_type *f = > fmt_pair_to_conv_functions[av_get_packed_sample_fmt(out_fmt) + > AV_SAMPLE_FMT_NB*av_get_packed_sample_fmt(in_fmt)]; > + > + size_t idx = av_get_packed_sample_fmt(out_fmt) + AV_SAMPLE_FMT_NB * > av_get_packed_sample_fmt(in_fmt); > + if (idx >= AV_SAMPLE_FMT_NB * AV_SAMPLE_FMT_NB) > + return NULL; > + > + conv_func_type *f = fmt_pair_to_conv_functions[idx]; > This is not necessary anymore, please remove this portion. > diff --git a/libswresample/swresample.c b/libswresample/swresample.c > index 6dc329a9d0..b7cab36710 100644 > --- a/libswresample/swresample.c > +++ b/libswresample/swresample.c > @@ -196,11 +196,11 @@ av_cold int swr_init(struct SwrContext *s){ > > clear_context(s); > > - if(s-> in_sample_fmt >= AV_SAMPLE_FMT_NB){ > + if(s-> in_sample_fmt >= AV_SAMPLE_FMT_NB || s-> in_sample_fmt < 0){ > av_log(s, AV_LOG_ERROR, "Requested input sample format %d is > invalid\n", s->in_sample_fmt); > return AVERROR(EINVAL); > } > - if(s->out_sample_fmt >= AV_SAMPLE_FMT_NB){ > + if(s->out_sample_fmt >= AV_SAMPLE_FMT_NB || s->out_sample_fmt < 0){ > av_log(s, AV_LOG_ERROR, "Requested output sample format %d is > invalid\n", s->out_sample_fmt); > return AVERROR(EINVAL); > } > -- > 2.25.1 > You can simplify this to "if ((unsigned) s->in/out_sample_fmt >= AV_SAMPLE_FMT_NB)". Ronald _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
