Message ID | 20191023185714.2412-2-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | 698e042c77ecb5b0d616de254adc783e8b61b9c4 |
Headers | show |
On Wed, Oct 23, 2019 at 08:57:12PM +0200, Michael Niedermayer wrote: > Fixes: Timeout (15sec -> 91ms) > Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/vp5.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c > index 0fca282918..f3946f508c 100644 > --- a/libavcodec/vp5.c > +++ b/libavcodec/vp5.c > @@ -48,6 +48,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size) > ff_vp56_init_dequant(s, vp56_rac_gets(c, 6)); > if (s->frames[VP56_FRAME_CURRENT]->key_frame) > { > + int render_x, render_y; > + > vp56_rac_gets(c, 8); > if(vp56_rac_gets(c, 5) > 5) > return AVERROR_INVALIDDATA; > @@ -63,8 +65,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size) > cols << 4, rows << 4); > return AVERROR_INVALIDDATA; > } > - vp56_rac_gets(c, 8); /* number of displayed macroblock rows */ > - vp56_rac_gets(c, 8); /* number of displayed macroblock cols */ > + render_y = vp56_rac_gets(c, 8); /* number of displayed macroblock rows */ > + render_x = vp56_rac_gets(c, 8); /* number of displayed macroblock cols */ > + if (render_x == 0 || render_x > cols || > + render_y == 0 || render_y > rows) > + return AVERROR_INVALIDDATA; > vp56_rac_gets(c, 2); > if (!s->macroblocks || /* first frame */ > 16*cols != s->avctx->coded_width || looks good. approve -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
On Thu, Oct 24, 2019 at 08:37:09PM +1100, Peter Ross wrote: > On Wed, Oct 23, 2019 at 08:57:12PM +0200, Michael Niedermayer wrote: > > Fixes: Timeout (15sec -> 91ms) > > Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/vp5.c | 9 +++++++-- > > 1 file changed, 7 insertions(+), 2 deletions(-) > > > > diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c > > index 0fca282918..f3946f508c 100644 > > --- a/libavcodec/vp5.c > > +++ b/libavcodec/vp5.c > > @@ -48,6 +48,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size) > > ff_vp56_init_dequant(s, vp56_rac_gets(c, 6)); > > if (s->frames[VP56_FRAME_CURRENT]->key_frame) > > { > > + int render_x, render_y; > > + > > vp56_rac_gets(c, 8); > > if(vp56_rac_gets(c, 5) > 5) > > return AVERROR_INVALIDDATA; > > @@ -63,8 +65,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size) > > cols << 4, rows << 4); > > return AVERROR_INVALIDDATA; > > } > > - vp56_rac_gets(c, 8); /* number of displayed macroblock rows */ > > - vp56_rac_gets(c, 8); /* number of displayed macroblock cols */ > > + render_y = vp56_rac_gets(c, 8); /* number of displayed macroblock rows */ > > + render_x = vp56_rac_gets(c, 8); /* number of displayed macroblock cols */ > > + if (render_x == 0 || render_x > cols || > > + render_y == 0 || render_y > rows) > > + return AVERROR_INVALIDDATA; > > vp56_rac_gets(c, 2); > > if (!s->macroblocks || /* first frame */ > > 16*cols != s->avctx->coded_width || > > looks good. approve will apply thx [...]
diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c index 0fca282918..f3946f508c 100644 --- a/libavcodec/vp5.c +++ b/libavcodec/vp5.c @@ -48,6 +48,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size) ff_vp56_init_dequant(s, vp56_rac_gets(c, 6)); if (s->frames[VP56_FRAME_CURRENT]->key_frame) { + int render_x, render_y; + vp56_rac_gets(c, 8); if(vp56_rac_gets(c, 5) > 5) return AVERROR_INVALIDDATA; @@ -63,8 +65,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size) cols << 4, rows << 4); return AVERROR_INVALIDDATA; } - vp56_rac_gets(c, 8); /* number of displayed macroblock rows */ - vp56_rac_gets(c, 8); /* number of displayed macroblock cols */ + render_y = vp56_rac_gets(c, 8); /* number of displayed macroblock rows */ + render_x = vp56_rac_gets(c, 8); /* number of displayed macroblock cols */ + if (render_x == 0 || render_x > cols || + render_y == 0 || render_y > rows) + return AVERROR_INVALIDDATA; vp56_rac_gets(c, 2); if (!s->macroblocks || /* first frame */ 16*cols != s->avctx->coded_width ||
Fixes: Timeout (15sec -> 91ms) Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/vp5.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)