diff mbox

[FFmpeg-devel,2/4] avcodec/vp5: Check render_x/y

Message ID 20191023185714.2412-2-michael@niedermayer.cc
State Accepted
Commit 698e042c77ecb5b0d616de254adc783e8b61b9c4
Headers show

Commit Message

Michael Niedermayer Oct. 23, 2019, 6:57 p.m. UTC 
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/vp5.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

Comments

Peter Ross Oct. 24, 2019, 9:37 a.m. UTC | #1 
On Wed, Oct 23, 2019 at 08:57:12PM +0200, Michael Niedermayer wrote:
> Fixes: Timeout (15sec -> 91ms)
> Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/vp5.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c
> index 0fca282918..f3946f508c 100644
> --- a/libavcodec/vp5.c
> +++ b/libavcodec/vp5.c
> @@ -48,6 +48,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
>      ff_vp56_init_dequant(s, vp56_rac_gets(c, 6));
>      if (s->frames[VP56_FRAME_CURRENT]->key_frame)
>      {
> +        int render_x, render_y;
> +
>          vp56_rac_gets(c, 8);
>          if(vp56_rac_gets(c, 5) > 5)
>              return AVERROR_INVALIDDATA;
> @@ -63,8 +65,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
>                     cols << 4, rows << 4);
>              return AVERROR_INVALIDDATA;
>          }
> -        vp56_rac_gets(c, 8);  /* number of displayed macroblock rows */
> -        vp56_rac_gets(c, 8);  /* number of displayed macroblock cols */
> +        render_y = vp56_rac_gets(c, 8);  /* number of displayed macroblock rows */
> +        render_x = vp56_rac_gets(c, 8);  /* number of displayed macroblock cols */
> +        if (render_x == 0 || render_x > cols ||
> +            render_y == 0 || render_y > rows)
> +            return AVERROR_INVALIDDATA;
>          vp56_rac_gets(c, 2);
>          if (!s->macroblocks || /* first frame */
>              16*cols != s->avctx->coded_width ||

looks good. approve

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
Michael Niedermayer Oct. 24, 2019, 10:17 p.m. UTC | #2 
On Thu, Oct 24, 2019 at 08:37:09PM +1100, Peter Ross wrote:
> On Wed, Oct 23, 2019 at 08:57:12PM +0200, Michael Niedermayer wrote:
> > Fixes: Timeout (15sec -> 91ms)
> > Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/vp5.c | 9 +++++++--
> >  1 file changed, 7 insertions(+), 2 deletions(-)
> > 
> > diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c
> > index 0fca282918..f3946f508c 100644
> > --- a/libavcodec/vp5.c
> > +++ b/libavcodec/vp5.c
> > @@ -48,6 +48,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
> >      ff_vp56_init_dequant(s, vp56_rac_gets(c, 6));
> >      if (s->frames[VP56_FRAME_CURRENT]->key_frame)
> >      {
> > +        int render_x, render_y;
> > +
> >          vp56_rac_gets(c, 8);
> >          if(vp56_rac_gets(c, 5) > 5)
> >              return AVERROR_INVALIDDATA;
> > @@ -63,8 +65,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
> >                     cols << 4, rows << 4);
> >              return AVERROR_INVALIDDATA;
> >          }
> > -        vp56_rac_gets(c, 8);  /* number of displayed macroblock rows */
> > -        vp56_rac_gets(c, 8);  /* number of displayed macroblock cols */
> > +        render_y = vp56_rac_gets(c, 8);  /* number of displayed macroblock rows */
> > +        render_x = vp56_rac_gets(c, 8);  /* number of displayed macroblock cols */
> > +        if (render_x == 0 || render_x > cols ||
> > +            render_y == 0 || render_y > rows)
> > +            return AVERROR_INVALIDDATA;
> >          vp56_rac_gets(c, 2);
> >          if (!s->macroblocks || /* first frame */
> >              16*cols != s->avctx->coded_width ||
> 
> looks good. approve

will apply

thx

[...]
diff mbox

Patch

diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c
index 0fca282918..f3946f508c 100644
--- a/libavcodec/vp5.c
+++ b/libavcodec/vp5.c
@@ -48,6 +48,8 @@  static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
     ff_vp56_init_dequant(s, vp56_rac_gets(c, 6));
     if (s->frames[VP56_FRAME_CURRENT]->key_frame)
     {
+        int render_x, render_y;
+
         vp56_rac_gets(c, 8);
         if(vp56_rac_gets(c, 5) > 5)
             return AVERROR_INVALIDDATA;
@@ -63,8 +65,11 @@  static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
                    cols << 4, rows << 4);
             return AVERROR_INVALIDDATA;
         }
-        vp56_rac_gets(c, 8);  /* number of displayed macroblock rows */
-        vp56_rac_gets(c, 8);  /* number of displayed macroblock cols */
+        render_y = vp56_rac_gets(c, 8);  /* number of displayed macroblock rows */
+        render_x = vp56_rac_gets(c, 8);  /* number of displayed macroblock cols */
+        if (render_x == 0 || render_x > cols ||
+            render_y == 0 || render_y > rows)
+            return AVERROR_INVALIDDATA;
         vp56_rac_gets(c, 2);
         if (!s->macroblocks || /* first frame */
             16*cols != s->avctx->coded_width ||