[FFmpeg-cvslog] avcodec/sunrast: Check that the input is large enough for the maximally compressed image

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sat Sep 21 18:14:03 2019 +0200| [bf0ba75c4a9231ed62afe60bed5bde2728971e30] | committer: Michael Niedermayer

avcodec/sunrast: Check that the input is large enough for the maximally compressed image

Fixes: Timeout (17sec -> 15ms)
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5663218491457536
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5735590015795200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bf0ba75c4a9231ed62afe60bed5bde2728971e30
---

 libavcodec/sunrast.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c
index 98bc4ffa63..e1ec8a0832 100644
--- a/libavcodec/sunrast.c
+++ b/libavcodec/sunrast.c
@@ -100,7 +100,11 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
     if (ret < 0)
         return ret;
 
-    if (buf_end - buf < maplength)
+    /* scanlines are aligned on 16 bit boundaries */
+    len  = (depth * w + 7) >> 3;
+    alen = len + (len & 1);
+
+    if (buf_end - buf < maplength + (len * h) * 3 / 256)
         return AVERROR_INVALIDDATA;
 
     if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
@@ -136,10 +140,6 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
         stride = p->linesize[0];
     }
 
-    /* scanlines are aligned on 16 bit boundaries */
-    len  = (depth * w + 7) >> 3;
-    alen = len + (len & 1);
-
     if (type == RT_BYTE_ENCODED) {
         int value, run;
         uint8_t *end = ptr + h * stride;