| Message ID | 20221118210918.3169-3-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 93810a625cb7d0dc174576951519ce72321c9f66 |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avcodec/tiff: Ignore tile_count | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | fail | Make fate failed |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
Please ignore fail info form loongarch64 patchwork temporarily. I have stoped the service from Nov 16th, but there are still result post to patchwork. Have mailed to Andriy to help analyze this problem together. > 2022年11月19日 05:09，Michael Niedermayer <michael@niedermayer.cc> 写道： > > Fixes: Timeout > Fixes: 52566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-4913160050311168 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/mobiclip.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c > index aca462428c..c3b2383dbc 100644 > --- a/libavcodec/mobiclip.c > +++ b/libavcodec/mobiclip.c > @@ -1216,6 +1216,9 @@ static int mobiclip_decode(AVCodecContext *avctx, AVFrame *rframe, > AVFrame *frame = s->pic[s->current_pic]; > int ret; > > + if (avctx->height/16 * (avctx->width/16) * 2 > 8LL*FFALIGN(pkt->size, 2)) > + return AVERROR_INVALIDDATA; > + > av_fast_padded_malloc(&s->bitstream, &s->bitstream_size, > pkt->size); > > -- > 2.17.1 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
On Fri, Nov 18, 2022 at 10:09:17PM +0100, Michael Niedermayer wrote: > Fixes: Timeout > Fixes: 52566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-4913160050311168 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/mobiclip.c | 3 +++ > 1 file changed, 3 insertions(+) will apply [...]
diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c index aca462428c..c3b2383dbc 100644 --- a/libavcodec/mobiclip.c +++ b/libavcodec/mobiclip.c @@ -1216,6 +1216,9 @@ static int mobiclip_decode(AVCodecContext *avctx, AVFrame *rframe, AVFrame *frame = s->pic[s->current_pic]; int ret; + if (avctx->height/16 * (avctx->width/16) * 2 > 8LL*FFALIGN(pkt->size, 2)) + return AVERROR_INVALIDDATA; + av_fast_padded_malloc(&s->bitstream, &s->bitstream_size, pkt->size);
Fixes: Timeout Fixes: 52566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-4913160050311168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/mobiclip.c | 3 +++ 1 file changed, 3 insertions(+)