| Message ID | 20190410235028.21612-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 3308e3da045e8a01ee08affa33a2d424629ca2e3 |
| Headers | show |
On 4/11/19, Michael Niedermayer <michael@niedermayer.cc> wrote: > Fixes: out of array access > Fixes: > 14110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5649184864075776 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/agm.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/agm.c b/libavcodec/agm.c > index cbd45e8095..b538854613 100644 > --- a/libavcodec/agm.c > +++ b/libavcodec/agm.c > @@ -578,6 +578,9 @@ static int decode_frame(AVCodecContext *avctx, void > *data, > av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n"); > return AVERROR_INVALIDDATA; > } > + if (s->prev_frame-> width != frame->width || > + s->prev_frame->height != frame->height) > + return AVERROR_INVALIDDATA; > > if (!(s->flags & 2)) { > ret = av_frame_copy(frame, s->prev_frame); LGTM
On Thu, Apr 11, 2019 at 10:21:49AM +0200, Paul B Mahol wrote: > On 4/11/19, Michael Niedermayer <michael@niedermayer.cc> wrote: > > Fixes: out of array access > > Fixes: > > 14110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5649184864075776 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/agm.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/libavcodec/agm.c b/libavcodec/agm.c > > index cbd45e8095..b538854613 100644 > > --- a/libavcodec/agm.c > > +++ b/libavcodec/agm.c > > @@ -578,6 +578,9 @@ static int decode_frame(AVCodecContext *avctx, void > > *data, > > av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n"); > > return AVERROR_INVALIDDATA; > > } > > + if (s->prev_frame-> width != frame->width || > > + s->prev_frame->height != frame->height) > > + return AVERROR_INVALIDDATA; > > > > if (!(s->flags & 2)) { > > ret = av_frame_copy(frame, s->prev_frame); > > LGTM will apply thx [...]
diff --git a/libavcodec/agm.c b/libavcodec/agm.c index cbd45e8095..b538854613 100644 --- a/libavcodec/agm.c +++ b/libavcodec/agm.c @@ -578,6 +578,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n"); return AVERROR_INVALIDDATA; } + if (s->prev_frame-> width != frame->width || + s->prev_frame->height != frame->height) + return AVERROR_INVALIDDATA; if (!(s->flags & 2)) { ret = av_frame_copy(frame, s->prev_frame);
Fixes: out of array access Fixes: 14110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5649184864075776 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/agm.c | 3 +++ 1 file changed, 3 insertions(+)