diff mbox

[FFmpeg-devel,2/2] avcodec/webp: Fixes null pointer dereference

Message ID 20170510163750.19352-2-michael@niedermayer.cc
State Accepted
Commit 67020711b7d45afa073ef671f755765035a64373
Headers show

Commit Message

Michael Niedermayer May 10, 2017, 4:37 p.m. UTC
Fixes: 1470/clusterfuzz-testcase-minimized-5404421666111488
Fixes: 1472/clusterfuzz-testcase-minimized-5677426430443520

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/webp.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Ronald S. Bultje May 10, 2017, 6:11 p.m. UTC | #1
Hi,

On Wed, May 10, 2017 at 12:37 PM, Michael Niedermayer <
michael@niedermayer.cc> wrote:

> Fixes: 1470/clusterfuzz-testcase-minimized-5404421666111488
> Fixes: 1472/clusterfuzz-testcase-minimized-5677426430443520
>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/webp.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/libavcodec/webp.c b/libavcodec/webp.c
> index e0cd72d03a..1eebb8ccef 100644
> --- a/libavcodec/webp.c
> +++ b/libavcodec/webp.c
> @@ -1351,6 +1351,9 @@ static int vp8_lossy_decode_frame(AVCodecContext
> *avctx, AVFrame *p,
>      if (ret < 0)
>          return ret;
>
> +    if (!*got_frame)
> +        return AVERROR_INVALIDDATA;


This has real meaning - it suggests alt-ref frames don't have alpha planes.
Suggestions:
- please confirm that with @skal;
- return 0, not AVERROR_INVALIDDATA, since alt-ref frames aren't decoding
errors.

Ronald
Ronald S. Bultje May 10, 2017, 6:19 p.m. UTC | #2
Hi,

On Wed, May 10, 2017 at 2:11 PM, Ronald S. Bultje <rsbultje@gmail.com>
wrote:

> - return 0, not AVERROR_INVALIDDATA, since alt-ref frames aren't decoding
> errors.
>

I'm also not sure if alt-ref frames in webp (since it's intra-only) make
any sense. Hmm...

Ronald
Michael Niedermayer May 10, 2017, 8:56 p.m. UTC | #3
On Wed, May 10, 2017 at 02:19:48PM -0400, Ronald S. Bultje wrote:
> Hi,
> 
> On Wed, May 10, 2017 at 2:11 PM, Ronald S. Bultje <rsbultje@gmail.com>
> wrote:
> 
> > - return 0, not AVERROR_INVALIDDATA, since alt-ref frames aren't decoding
> > errors.
> >
> 
> I'm also not sure if alt-ref frames in webp (since it's intra-only) make
> any sense. Hmm...

i would think that if the vp8 decoder doesnt produce a output frame
then thats invalid "AVERROR_INVALIDDATA" in webp independant of it
being valid in VP8

CC-ing skal as suggested

thx

[...]
diff mbox

Patch

diff --git a/libavcodec/webp.c b/libavcodec/webp.c
index e0cd72d03a..1eebb8ccef 100644
--- a/libavcodec/webp.c
+++ b/libavcodec/webp.c
@@ -1351,6 +1351,9 @@  static int vp8_lossy_decode_frame(AVCodecContext *avctx, AVFrame *p,
     if (ret < 0)
         return ret;
 
+    if (!*got_frame)
+        return AVERROR_INVALIDDATA;
+
     update_canvas_size(avctx, avctx->width, avctx->height);
 
     if (s->has_alpha) {