[FFmpeg-devel] [PATCH 2/4] avcodec/vp5: Check render_x/y
Michael Niedermayer
michael at niedermayer.cc
Wed Oct 23 21:57:12 EEST 2019
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
libavcodec/vp5.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c
index 0fca282918..f3946f508c 100644
--- a/libavcodec/vp5.c
+++ b/libavcodec/vp5.c
@@ -48,6 +48,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
ff_vp56_init_dequant(s, vp56_rac_gets(c, 6));
if (s->frames[VP56_FRAME_CURRENT]->key_frame)
{
+ int render_x, render_y;
+
vp56_rac_gets(c, 8);
if(vp56_rac_gets(c, 5) > 5)
return AVERROR_INVALIDDATA;
@@ -63,8 +65,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
cols << 4, rows << 4);
return AVERROR_INVALIDDATA;
}
- vp56_rac_gets(c, 8); /* number of displayed macroblock rows */
- vp56_rac_gets(c, 8); /* number of displayed macroblock cols */
+ render_y = vp56_rac_gets(c, 8); /* number of displayed macroblock rows */
+ render_x = vp56_rac_gets(c, 8); /* number of displayed macroblock cols */
+ if (render_x == 0 || render_x > cols ||
+ render_y == 0 || render_y > rows)
+ return AVERROR_INVALIDDATA;
vp56_rac_gets(c, 2);
if (!s->macroblocks || /* first frame */
16*cols != s->avctx->coded_width ||
--
2.23.0
More information about the ffmpeg-devel
mailing list