| Message ID | 20210215202313.1228-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 6a797ceafe2a96aa1682a1eca421eddd4c498275 |
| Headers | show |
| Series | [FFmpeg-devel,1/3] avcodec/vp8: Move end check into MB loop in vp78_decode_mv_mb_modes() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
On Mon, Feb 15, 2021 at 09:23:11PM +0100, Michael Niedermayer wrote: > Fixes: Timeout (long -> 5sec) > Fixes: 30269/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP7_fuzzer-5430325004075008 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/vp8.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c > index 5fa7971f8f..89c48e6cb1 100644 > --- a/libavcodec/vp8.c > +++ b/libavcodec/vp8.c > @@ -2293,10 +2293,10 @@ int vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe, > s->mv_bounds.mv_min.x = -MARGIN; > s->mv_bounds.mv_max.x = ((s->mb_width - 1) << 6) + MARGIN; > > - if (vpX_rac_is_end(&s->c)) { > - return AVERROR_INVALIDDATA; > - } > for (mb_x = 0; mb_x < s->mb_width; mb_x++, mb_xy++, mb++) { > + if (vpX_rac_is_end(&s->c)) { > + return AVERROR_INVALIDDATA; > + } > if (mb_y == 0) > AV_WN32A((mb - s->mb_width - 1)->intra4x4_pred_mode_top, > DC_PRED * 0x01010101); ok -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
On Tue, Feb 16, 2021 at 06:48:05PM +1100, Peter Ross wrote: > On Mon, Feb 15, 2021 at 09:23:11PM +0100, Michael Niedermayer wrote: > > Fixes: Timeout (long -> 5sec) > > Fixes: 30269/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP7_fuzzer-5430325004075008 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/vp8.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > > > > diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c > > index 5fa7971f8f..89c48e6cb1 100644 > > --- a/libavcodec/vp8.c > > +++ b/libavcodec/vp8.c > > @@ -2293,10 +2293,10 @@ int vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe, > > s->mv_bounds.mv_min.x = -MARGIN; > > s->mv_bounds.mv_max.x = ((s->mb_width - 1) << 6) + MARGIN; > > > > - if (vpX_rac_is_end(&s->c)) { > > - return AVERROR_INVALIDDATA; > > - } > > for (mb_x = 0; mb_x < s->mb_width; mb_x++, mb_xy++, mb++) { > > + if (vpX_rac_is_end(&s->c)) { > > + return AVERROR_INVALIDDATA; > > + } > > if (mb_y == 0) > > AV_WN32A((mb - s->mb_width - 1)->intra4x4_pred_mode_top, > > DC_PRED * 0x01010101); > > ok will apply thx [...]
diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index 5fa7971f8f..89c48e6cb1 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -2293,10 +2293,10 @@ int vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe, s->mv_bounds.mv_min.x = -MARGIN; s->mv_bounds.mv_max.x = ((s->mb_width - 1) << 6) + MARGIN; - if (vpX_rac_is_end(&s->c)) { - return AVERROR_INVALIDDATA; - } for (mb_x = 0; mb_x < s->mb_width; mb_x++, mb_xy++, mb++) { + if (vpX_rac_is_end(&s->c)) { + return AVERROR_INVALIDDATA; + } if (mb_y == 0) AV_WN32A((mb - s->mb_width - 1)->intra4x4_pred_mode_top, DC_PRED * 0x01010101);
Fixes: Timeout (long -> 5sec) Fixes: 30269/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP7_fuzzer-5430325004075008 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/vp8.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)