[FFmpeg-devel] [PATCH 2/2] avcodec/mpeg4videodec: Check pixel size against packet size

[Michael Niedermayer]

Fixes: Timeout
Fixes: 46866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5114397204283392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/mpeg4videodec.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index e2bde73639..267a79a62f 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -2337,8 +2337,14 @@ static int decode_studio_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
         /* Do the same check as non-studio profile */
         if (width && height) {
             if (s->width && s->height &&
-                (s->width != width || s->height != height))
+                (s->width != width || s->height != height)) {
+                if (width*height / 256 > get_bits_left(gb)) {
+                    av_log(s->avctx, AV_LOG_ERROR, "Impossible size for this frame\n");
+                    return AVERROR_INVALIDDATA;
+                }
+
                 s->context_reinit = 1;
+            }
             s->width  = width;
             s->height = height;
         }
@@ -2485,8 +2491,13 @@ static int decode_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
             if (width && height &&  /* they should be non zero but who knows */
                 !(s->width && s->codec_tag == AV_RL32("MP4S"))) {
                 if (s->width && s->height &&
-                    (s->width != width || s->height != height))
+                    (s->width != width || s->height != height)) {
+                    if (width*height/256 > get_bits_left(gb)) {
+                        av_log(s->avctx, AV_LOG_ERROR, "Impossible size for this frame\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     s->context_reinit = 1;
+                }
                 s->width  = width;
                 s->height = height;
             }
-- 
2.17.1