[FFmpeg-devel] [PATCH] avcodec/gdv: Check input palette size before rescale()

[Paul B Mahol]

On 4/25/19, Michael Niedermayer <michael at niedermayer.cc> wrote:
> Fixes: Timeout (22sec -> 11sec)
> Fixes:
> 13576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5681024577568768
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/gdv.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/gdv.c b/libavcodec/gdv.c
> index 183286b55f..0c16ad850a 100644
> --- a/libavcodec/gdv.c
> +++ b/libavcodec/gdv.c
> @@ -475,15 +475,14 @@ static int gdv_decode_frame(AVCodecContext *avctx,
> void *data,
>      if (pal && pal_size == AVPALETTE_SIZE)
>          memcpy(gdv->pal, pal, AVPALETTE_SIZE);
>
> +    if (compression < 2 && bytestream2_get_bytes_left(gb) < 256*3)
> +        return AVERROR_INVALIDDATA;
>      rescale(gdv, gdv->frame, avctx->width, avctx->height,
>              !!(flags & 0x10), !!(flags & 0x20));
> -

Unrelated.

>      switch (compression) {
>      case 1:
>          memset(gdv->frame + PREAMBLE_SIZE, 0, gdv->frame_size -
> PREAMBLE_SIZE);
>      case 0:
> -        if (bytestream2_get_bytes_left(gb) < 256*3)
> -            return AVERROR_INVALIDDATA;
>          for (i = 0; i < 256; i++) {
>              unsigned r = bytestream2_get_byte(gb);
>              unsigned g = bytestream2_get_byte(gb);
> --
> 2.21.0

Otherwise ok.