| Message ID | 20181117020145.17164-3-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Headers | show |
lör 2018-11-17 klockan 03:01 +0100 skrev Michael Niedermayer: > Fixes: Timeout > Fixes: 10984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6643310750859264 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/truemotion2.c | 15 ++++++++++----- > 1 file changed, 10 insertions(+), 5 deletions(-) > > diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c > index c583ff4032..5d12a70839 100644 > --- a/libavcodec/truemotion2.c > +++ b/libavcodec/truemotion2.c > @@ -114,7 +114,7 @@ typedef struct TM2Huff { > > static int tm2_read_tree(TM2Context *ctx, uint32_t prefix, int length, TM2Huff *huff) Since you seem to be changing what this function returns, a comment saying what it returns would be nice Don't have much else to say about the patch since I don't know this format /Tomas
On Sun, Nov 18, 2018 at 11:29:10PM +0100, Tomas Härdin wrote: > lör 2018-11-17 klockan 03:01 +0100 skrev Michael Niedermayer: > > Fixes: Timeout > > Fixes: 10984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6643310750859264 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/truemotion2.c | 15 ++++++++++----- > > 1 file changed, 10 insertions(+), 5 deletions(-) > > > > diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c > > index c583ff4032..5d12a70839 100644 > > --- a/libavcodec/truemotion2.c > > +++ b/libavcodec/truemotion2.c > > @@ -114,7 +114,7 @@ typedef struct TM2Huff { > > > > static int tm2_read_tree(TM2Context *ctx, uint32_t prefix, int length, TM2Huff *huff) > > Since you seem to be changing what this function returns, a comment > saying what it returns would be nice will document this better thanks [...]
diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index c583ff4032..5d12a70839 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -114,7 +114,7 @@ typedef struct TM2Huff { static int tm2_read_tree(TM2Context *ctx, uint32_t prefix, int length, TM2Huff *huff) { - int ret; + int ret, ret2; if (length > huff->max_bits) { av_log(ctx->avctx, AV_LOG_ERROR, "Tree exceeded its given depth (%i)\n", huff->max_bits); @@ -133,14 +133,14 @@ static int tm2_read_tree(TM2Context *ctx, uint32_t prefix, int length, TM2Huff * huff->bits[huff->num] = prefix; huff->lens[huff->num] = length; huff->num++; - return 0; + return length; } else { /* non-terminal node */ - if ((ret = tm2_read_tree(ctx, prefix << 1, length + 1, huff)) < 0) - return ret; + if ((ret2 = tm2_read_tree(ctx, prefix << 1, length + 1, huff)) < 0) + return ret2; if ((ret = tm2_read_tree(ctx, (prefix << 1) | 1, length + 1, huff)) < 0) return ret; } - return 0; + return FFMAX(ret, ret2); } static int tm2_build_huff_table(TM2Context *ctx, TM2Codes *code) @@ -183,6 +183,11 @@ static int tm2_build_huff_table(TM2Context *ctx, TM2Codes *code) res = tm2_read_tree(ctx, 0, 0, &huff); + if (res >= 0 && res != huff.max_bits) { + av_log(ctx->avctx, AV_LOG_ERROR, "Got less bits than expected: %i of %i\n", + res, huff.max_bits); + res = AVERROR_INVALIDDATA; + } if (huff.num != huff.max_num) { av_log(ctx->avctx, AV_LOG_ERROR, "Got less codes than expected: %i of %i\n", huff.num, huff.max_num);
Fixes: Timeout Fixes: 10984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6643310750859264 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/truemotion2.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)