@@ -37,6 +37,7 @@
#include "libavutil/avstring.h"
#include "libavutil/intreadwrite.h"
#include "libavutil/imgutils.h"
+#include "libavutil/loop_detector.h"
#include "libavutil/opt.h"
#include "avcodec.h"
#include "bytestream.h"
@@ -1407,6 +1408,7 @@ static int decode_frame(AVCodecContext *avctx,
GetByteContext stripsizes;
GetByteContext stripdata;
int retry_for_subifd, retry_for_page;
+ AVSimpleLoopDetector loop_detector = {0};
bytestream2_init(&s->gb, avpkt->data, avpkt->size);
@@ -1467,6 +1469,10 @@ again:
av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n");
return AVERROR_INVALIDDATA;
}
+ if (av_is_loop(&loop_detector, off, INT64_MAX)) {
+ av_log(avctx, AV_LOG_ERROR, "too many retries\n");
+ return AVERROR_INVALIDDATA;
+ }
s->sub_ifd = 0;
goto again;
}
Fixes: Timeout (Infinite -> 26ms) Fixes: 15706/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5114674904825856 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/tiff.c | 6 ++++++ 1 file changed, 6 insertions(+)