[FFmpeg-devel] [PATCH] avcodec/fits: Check bitpix

[Paul B Mahol]

On 5/5/19, Michael Niedermayer <michael at niedermayer.cc> wrote:
> Reference: Table 8: Interpretation of valid BITPIX value from FITS standard
> 4.0
> Fixes: runtime error: division by zero
> Fixes:
> 14581/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5652382425284608
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/fits.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>
> diff --git a/libavcodec/fits.c b/libavcodec/fits.c
> index 365347fc64..ad73ab70de 100644
> --- a/libavcodec/fits.c
> +++ b/libavcodec/fits.c
> @@ -138,6 +138,17 @@ int avpriv_fits_header_parse_line(void *avcl,
> FITSHeader *header, const uint8_t
>      case STATE_BITPIX:
>          CHECK_KEYWORD("BITPIX");
>          CHECK_VALUE("BITPIX", bitpix);
> +
> +        switch(header->bitpix) {
> +        case   8:
> +        case  16:
> +        case  32: case -32:
> +        case  64: case -64: break;
> +        default:
> +            av_log(avcl, AV_LOG_ERROR, "invalid value of BITPIX %d\n",
> header->bitpix); \
> +            return AVERROR_INVALIDDATA;
> +        }
> +
>          dict_set_if_not_null(metadata, keyword, value);
>
>          header->state = STATE_NAXIS;
> --
> 2.21.0

OK