[FFmpeg-devel] [PATCH 1/4] avcodec/vp3: Check for end of input in 2 places of vp4_unpack_macroblocks()

[Michael Niedermayer]

On Mon, Sep 02, 2019 at 06:33:43PM +1000, Peter Ross wrote:
> On Sun, Sep 01, 2019 at 11:10:25PM +0200, Michael Niedermayer wrote:
> > Fixes: Timeout (82sec -> 1sec)
> > Fixes: 16411/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP3_fuzzer-5166958151991296
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/vp3.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> > 
> > diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
> > index 28ed0461c7..a2bd2ef07d 100644
> > --- a/libavcodec/vp3.c
> > +++ b/libavcodec/vp3.c
> > @@ -710,6 +710,8 @@ static int vp4_unpack_macroblocks(Vp3DecodeContext *s, GetBitContext *gb)
> >      has_partial = 0;
> >      bit         = get_bits1(gb);
> >      for (i = 0; i < s->yuv_macroblock_count; i += current_run) {
> > +        if (get_bits_left(gb) <= 0)
> > +            return AVERROR_INVALIDDATA;
> >          current_run = vp4_get_mb_count(s, gb);
> >          if (current_run > s->yuv_macroblock_count - i)
> >              return -1;
> > @@ -719,6 +721,8 @@ static int vp4_unpack_macroblocks(Vp3DecodeContext *s, GetBitContext *gb)
> >      }
> >  
> >      if (has_partial) {
> > +        if (get_bits_left(gb) <= 0)
> > +            return AVERROR_INVALIDDATA;
> >          bit  = get_bits1(gb);
> >          current_run = vp4_get_mb_count(s, gb);
> >          for (i = 0; i < s->yuv_macroblock_count; i++) {
> > -- 
> > 2.23.0
> 
> approve.

will apply

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

While the State exists there can be no freedom; when there is freedom there
will be no State. -- Vladimir Lenin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20190902/159c550c/attachment.sig>