diff mbox

[FFmpeg-devel] avcodec/zmbv: Check that the decompressed data size is correct

Message ID 20180917222837.6094-1-michael@niedermayer.cc
State Accepted
Commit e33b28cc79d164fff22bfee750c9283587c00bc4
Headers show

Commit Message

Michael Niedermayer Sept. 17, 2018, 10:28 p.m. UTC 
This checks the value exactly for intra frames and checks it against a
minimum for inter frames as they can be variable.

Fixes: Timeout
Fixes: 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/zmbv.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

Comments

Paul B Mahol Sept. 18, 2018, 7:04 a.m. UTC | #1 
On 9/18/18, Michael Niedermayer <michael@niedermayer.cc> wrote:
> This checks the value exactly for intra frames and checks it against a
> minimum for inter frames as they can be variable.
>
> Fixes: Timeout
> Fixes:
> 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/zmbv.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
>

LGTM
Michael Niedermayer Sept. 18, 2018, 11:44 p.m. UTC | #2 
On Tue, Sep 18, 2018 at 09:04:14AM +0200, Paul B Mahol wrote:
> On 9/18/18, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > This checks the value exactly for intra frames and checks it against a
> > minimum for inter frames as they can be variable.
> >
> > Fixes: Timeout
> > Fixes:
> > 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704
> >
> > Found-by: continuous fuzzing process
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/zmbv.c | 14 ++++++++++++++
> >  1 file changed, 14 insertions(+)
> >
> 
> LGTM

will apply

thanks

[...]
diff mbox

Patch

diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c
index 177993d0a6..79e0892070 100644
--- a/libavcodec/zmbv.c
+++ b/libavcodec/zmbv.c
@@ -409,6 +409,7 @@  static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
     int zret = Z_OK; // Zlib return code
     int len = buf_size;
     int hi_ver, lo_ver, ret;
+    int expected_size;
 
     /* parse header */
     if (len < 1)
@@ -510,6 +511,14 @@  static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
         memset(c->prev, 0, avctx->width * avctx->height * (c->bpp / 8));
         c->decode_intra= decode_intra;
     }
+    if (c->flags & ZMBV_KEYFRAME) {
+        expected_size = avctx->width * avctx->height * (c->bpp / 8);
+    } else {
+        expected_size = (c->bx * c->by * 2 + 3) & ~3;
+    }
+    if (avctx->pix_fmt == AV_PIX_FMT_PAL8 &&
+        (c->flags & (ZMBV_DELTAPAL | ZMBV_KEYFRAME)))
+        expected_size += 768;
 
     if (!c->decode_intra) {
         av_log(avctx, AV_LOG_ERROR, "Error! Got no format or no keyframe!\n");
@@ -539,6 +548,11 @@  static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
         }
         c->decomp_len = c->zstream.total_out;
     }
+    if (expected_size > c->decomp_len ||
+        (c->flags & ZMBV_KEYFRAME) && expected_size < c->decomp_len) {
+        av_log(avctx, AV_LOG_ERROR, "decompressed size %d is incorrect, expected %d\n", c->decomp_len, expected_size);
+        return AVERROR_INVALIDDATA;
+    }
     if (c->flags & ZMBV_KEYFRAME) {
         frame->key_frame = 1;
         frame->pict_type = AV_PICTURE_TYPE_I;