[FFmpeg-devel] [PATCH] avcodec/sanm: Checks related to negative left/top

[Michael Niedermayer]

Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
Fixes: out of array access

CC: Manuel Lauss <manuel.lauss at gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/sanm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index 617b977ab70..d345f588463 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
     bytestream2_skip(gb, 2);
     parm2 = bytestream2_get_le16u(gb);
 
-    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
+    if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {
         av_log(ctx->avctx, AV_LOG_WARNING,
                "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
                codec, w, h, left, top);
@@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
             }
         }
     } else {
-        if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) {
+        if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) {
             /* correct unexpected overly large frames: this happens
              * for instance with The Dig's sq1.san video: it has a few
              * (all black) 640x480 frames halfway in, while the rest is
@@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
     if ((w == ctx->width) && (h == ctx->height)) {
         memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size);
     } else {
-        uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
         const uint8_t *src = (uint8_t *)ctx->frm0;
         const int cw = FFMIN(w, ctx->width - left);
         const int ch = FFMIN(h, ctx->height - top);
         if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) {
+            uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
             for (int i = 0; i < ch; i++) {
                 memcpy(dst, src, cw);
                 dst += ctx->pitch;
-- 
2.50.1