[FFmpeg-devel] [PATCH 2/4] avcodec/vp5: Check render_x/y
Peter Ross
pross at xvid.org
Thu Oct 24 12:37:09 EEST 2019
On Wed, Oct 23, 2019 at 08:57:12PM +0200, Michael Niedermayer wrote:
> Fixes: Timeout (15sec -> 91ms)
> Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
> libavcodec/vp5.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c
> index 0fca282918..f3946f508c 100644
> --- a/libavcodec/vp5.c
> +++ b/libavcodec/vp5.c
> @@ -48,6 +48,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
> ff_vp56_init_dequant(s, vp56_rac_gets(c, 6));
> if (s->frames[VP56_FRAME_CURRENT]->key_frame)
> {
> + int render_x, render_y;
> +
> vp56_rac_gets(c, 8);
> if(vp56_rac_gets(c, 5) > 5)
> return AVERROR_INVALIDDATA;
> @@ -63,8 +65,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
> cols << 4, rows << 4);
> return AVERROR_INVALIDDATA;
> }
> - vp56_rac_gets(c, 8); /* number of displayed macroblock rows */
> - vp56_rac_gets(c, 8); /* number of displayed macroblock cols */
> + render_y = vp56_rac_gets(c, 8); /* number of displayed macroblock rows */
> + render_x = vp56_rac_gets(c, 8); /* number of displayed macroblock cols */
> + if (render_x == 0 || render_x > cols ||
> + render_y == 0 || render_y > rows)
> + return AVERROR_INVALIDDATA;
> vp56_rac_gets(c, 2);
> if (!s->macroblocks || /* first frame */
> 16*cols != s->avctx->coded_width ||
looks good. approve
-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20191024/79361bd0/attachment.sig>
More information about the ffmpeg-devel
mailing list