[FFmpeg-devel] [PATCH 4/6] avcodec/pngdec: Check amount decoded

[Paul B Mahol]

NAK

On Sun, Aug 18, 2019 at 1:36 AM Michael Niedermayer <michael at niedermayer.cc>
wrote:

> Fixes: Timeout (70sec -> 243ms)
> Fixes:
> 16097/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5664690889293824
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/pngdec.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
> index 4ca4f7bdc1..6e6856ab3e 100644
> --- a/libavcodec/pngdec.c
> +++ b/libavcodec/pngdec.c
> @@ -320,6 +320,15 @@ static void deloco_ ## NAME(TYPE *dst, int size, int
> alpha) \
>  YUV2RGB(rgb8, uint8_t)
>  YUV2RGB(rgb16, uint16_t)
>
> +static int percent_missing(PNGDecContext *s)
> +{
> +    if (s->interlace_type) {
> +        return 100 - 100 * s->pass / (NB_PASSES - 1);
> +    } else {
> +        return 100 - 100 * s->y / s->cur_h;
> +    }
> +}
> +
>  /* process exactly one decompressed row */
>  static void png_handle_row(PNGDecContext *s)
>  {
> @@ -1354,6 +1363,9 @@ exit_loop:
>          return 0;
>      }
>
> +    if (percent_missing(s) > avctx->discard_damaged_percentage)
> +        return AVERROR_INVALIDDATA;
> +
>      if (s->bits_per_pixel <= 4)
>          handle_small_bpp(s, p);
>
> --
> 2.22.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".