[FFmpeg-devel] [PATCH 7/7] avcodec/cri: check for available input in unpack_10bit()

[Michael Niedermayer]

On Tue, Nov 10, 2020 at 01:46:10AM +0100, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > Fixes: Timeout (>20sec -> 56ms)
> > Fixes: 26995/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5107217080254464
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/cri.c | 11 +++++++----
> >  1 file changed, 7 insertions(+), 4 deletions(-)
> > 
> > diff --git a/libavcodec/cri.c b/libavcodec/cri.c
> > index dafbc1f1be..9bcd2ebfc6 100644
> > --- a/libavcodec/cri.c
> > +++ b/libavcodec/cri.c
> > @@ -80,10 +80,13 @@ static void unpack_10bit(GetByteContext *gb, uint16_t *dst, int shift,
> >      int pos = 0;
> >  
> >      while (count > 0) {
> > -        uint32_t a0 = bytestream2_get_le32(gb);
> > -        uint32_t a1 = bytestream2_get_le32(gb);
> > -        uint32_t a2 = bytestream2_get_le32(gb);
> > -        uint32_t a3 = bytestream2_get_le32(gb);
> > +        uint32_t a0, a1,a2,a3;
> > +        if (bytestream2_get_bytes_left(gb) < 4)
> > +            break;
> > +        a0 = bytestream2_get_le32(gb);
> > +        a1 = bytestream2_get_le32(gb);
> > +        a2 = bytestream2_get_le32(gb);
> > +        a3 = bytestream2_get_le32(gb);
> >          dst[pos] = (((a0 >> 1) & 0xE00) | (a0 & 0x1FF)) << shift;
> >          pos++;
> >          if (pos >= w) {
> > 
> Wouldn't it make sense to check for 16 bytes to be left given that
> that's the amount that is read immediately afterwards? And if you check
> for this, you could just use bytestream2_get_le32u().

the code can break out before using all 4 so i felt it was more
cautious to check only for the first

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Why not whip the teacher when the pupil misbehaves? -- Diogenes of Sinope
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20201110/967da1b0/attachment.sig>