diff mbox

[FFmpeg-devel,1/2] avcodec/indeo4: Check dimensions in decode_pic_hdr()

Message ID 20180826022002.7878-1-michael@niedermayer.cc
State Accepted
Commit 7592e88bfe3d5bf9109a55acd025af9110618405
Headers show

Commit Message

Michael Niedermayer Aug. 26, 2018, 2:20 a.m. UTC 
Fixes: Timeout
Fixes: 9654/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-6289863463665664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/indeo4.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Michael Niedermayer Sept. 2, 2018, 9:37 p.m. UTC | #1 
On Sun, Aug 26, 2018 at 04:20:01AM +0200, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 9654/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-6289863463665664
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/indeo4.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

will apply patchset

[...]
diff mbox

Patch

diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c
index 15ad6f8afc..4bfc6cdd74 100644
--- a/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@ -30,6 +30,7 @@ 
 #define BITSTREAM_READER_LE
 #include "avcodec.h"
 #include "get_bits.h"
+#include "libavutil/imgutils.h"
 #include "indeo4data.h"
 #include "internal.h"
 #include "ivi.h"
@@ -178,6 +179,13 @@  static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
     pic_conf.chroma_bands = 0;
     if (pic_conf.luma_bands)
         pic_conf.chroma_bands = decode_plane_subdivision(&ctx->gb);
+
+    if (av_image_check_size2(pic_conf.pic_width, pic_conf.pic_height, avctx->max_pixels, AV_PIX_FMT_YUV410P, 0, avctx) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "picture dimensions %d %d cannot be decoded\n",
+               pic_conf.pic_width, pic_conf.pic_height);
+        return AVERROR_INVALIDDATA;
+    }
+
     ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
     if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
         av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n",