[FFmpeg-devel] [PATCH 2/2] avcodec/zmbv: Check that the raw input is large enough to contain MVs or an intra frame

[Paul B Mahol]

On 9/16/18, Michael Niedermayer <michael at niedermayer.cc> wrote:
> Fixes: Timeout
> Fixes:
> 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/zmbv.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c
> index 9e27a2caad..1133bdf7ba 100644
> --- a/libavcodec/zmbv.c
> +++ b/libavcodec/zmbv.c
> @@ -409,6 +409,7 @@ static int decode_frame(AVCodecContext *avctx, void
> *data, int *got_frame, AVPac
>      int zret = Z_OK; // Zlib return code
>      int len = buf_size;
>      int hi_ver, lo_ver, ret;
> +    int min_size;
>
>      /* parse header */
>      if (len < 1)
> @@ -510,7 +511,11 @@ static int decode_frame(AVCodecContext *avctx, void
> *data, int *got_frame, AVPac
>          memset(c->prev, 0, avctx->width * avctx->height * (c->bpp / 8));
>          c->decode_intra= decode_intra;
>      }
> -
> +    if (c->flags & ZMBV_KEYFRAME) {
> +        min_size = avctx->width * avctx->height * (c->bpp / 8);

This is pure guessing?

> +    } else {
> +        min_size = (c->bx * c->by * 2 + 3) & ~3;
> +    }
>      if (!c->decode_intra) {
>          av_log(avctx, AV_LOG_ERROR, "Error! Got no format or no
> keyframe!\n");
>          return AVERROR_INVALIDDATA;
> @@ -524,6 +529,10 @@ static int decode_frame(AVCodecContext *avctx, void
> *data, int *got_frame, AVPac
>              av_log(avctx, AV_LOG_ERROR, "Buffer too small\n");
>              return AVERROR_INVALIDDATA;
>          }
> +        if (min_size > len) {
> +            av_log(avctx, AV_LOG_ERROR, "input too small\n");
> +            return AVERROR_INVALIDDATA;
> +        }
>          memcpy(c->decomp_buf, buf, len);
>      } else { // ZLIB-compressed data
>          c->zstream.total_in = c->zstream.total_out = 0;
> --
> 2.18.0
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>