[FFmpeg-devel] [PATCH 3/3] avcodec/vp6: clear dimensions on failed resolution change in vp6_parse_header()
Michael Niedermayer
michael at niedermayer.cc
Sun Mar 12 04:04:06 EET 2017
Fixes: 807/clusterfuzz-testcase-6470061042696192
Fixes null pointer dereference
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
libavcodec/vp6.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/libavcodec/vp6.c b/libavcodec/vp6.c
index f0e60a3822..4afd67b3a4 100644
--- a/libavcodec/vp6.c
+++ b/libavcodec/vp6.c
@@ -108,7 +108,7 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
ret = ff_vp56_init_range_decoder(c, buf+6, buf_size-6);
if (ret < 0)
- return ret;
+ goto fail;
vp56_rac_gets(c, 2);
parse_filter_info = s->filter_header;
@@ -162,9 +162,8 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
buf += coeff_offset;
buf_size -= coeff_offset;
if (buf_size < 0) {
- if (s->frames[VP56_FRAME_CURRENT]->key_frame)
- ff_set_dimensions(s->avctx, 0, 0);
- return AVERROR_INVALIDDATA;
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
}
if (s->use_huffman) {
s->parse_coeff = vp6_parse_coeff_huffman;
@@ -172,7 +171,7 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
} else {
ret = ff_vp56_init_range_decoder(&s->cc, buf, buf_size);
if (ret < 0)
- return ret;
+ goto fail;
s->ccp = &s->cc;
}
} else {
@@ -180,6 +179,10 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
}
return res;
+fail:
+ if (res == VP56_SIZE_CHANGE)
+ ff_set_dimensions(s->avctx, 0, 0);
+ return ret;
}
static void vp6_coeff_order_table_init(VP56Context *s)
--
2.11.0
More information about the ffmpeg-devel
mailing list