On Mon, Mar 21, 2022 at 06:03:12PM -0300, James Almer wrote: > On 2/1/2022 3:52 PM, Michael Niedermayer wrote: > > Fixes: division by zero > > Fixes: > > 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <[email protected]> > > --- > > libavcodec/av1dec.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c > > index 62d459cded..581f22a849 100644 > > --- a/libavcodec/av1dec.c > > +++ b/libavcodec/av1dec.c > > @@ -394,6 +394,9 @@ static int get_tiles_info(AVCodecContext *avctx, const > > AV1RawTileGroup *tile_gro > > s->tg_start = tile_group->tg_start; > > s->tg_end = tile_group->tg_end; > > + if (s->raw_frame_header->tile_cols == 0) > > This should not happen. CBS should have returned an error instead or setting > tile_cols to 0. > The bug should probably be fixed there.
I didnt see your mail in time :(
If you want, i can revert it?
The issue seems that cbs av1 and av1dec disagree on how they handle
redundant frames.
I can "fix" it by
--- a/libavcodec/av1dec.c
+++ b/libavcodec/av1dec.c
@@ -1066,8 +1066,8 @@ static int av1_decode_frame(AVCodecContext *avctx, void
*frame,
}
break;
case AV1_OBU_REDUNDANT_FRAME_HEADER:
- if (s->raw_frame_header)
- break;
+ // Unsupported
+ break;
// fall-through
case AV1_OBU_FRAME:
case AV1_OBU_FRAME_HEADER:
cbs leaves tile_cols untouched (and 0) for the redundant frame
I didnt really look further, this probably should be looked at by someone
who knows the av1dec/cbs code better. I can provide the sample file
if someone wants to or also test any suggested fixes
I think this split logic where cbs and the decoder have to be kept in
sync is a bit fragile. Or at least it looks fragile
Thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
If you fake or manipulate statistics in a paper in physics you will never
get a job again.
If you fake or manipulate statistics in a paper in medicin you will get
a job for life at the pharma industry.
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
