From patchwork Sat May 5 19:10:06 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 8794 Delivered-To: ffmpegpatchwork@gmail.com Received: by 2002:a02:155:0:0:0:0:0 with SMTP id c82-v6csp1322509jad; Sat, 5 May 2018 12:11:55 -0700 (PDT) X-Google-Smtp-Source: AB8JxZpycYOs23YBMRHEaZ+8KUwu96QEhA6HBrxd1BwGdP4A275NwvVQRaFuKuKqd7C2RT4VNeUJ X-Received: by 10.28.156.195 with SMTP id f186mr4218094wme.94.1525547515399; Sat, 05 May 2018 12:11:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1525547515; cv=none; d=google.com; s=arc-20160816; b=k6m8hbQr3EG2yrXBE08UWFZh1QnUIG6eHF/NWe+DVc0teZ2HEThlCX9LQvGOpbu8wb TBMz2rgEfvdHD2nAX5YWx14EqXmDgITBokNzVYHEaJJyeNidvDjhhMA5dg6esFrF0iUe GaIagiQ+N667+5dXW+ULrXDKt2GOPwodKYEsUWwhkbak9llLm5u8csILDfPNn7TRTGI8 aCfr5l0bVZ+bG8Cbi+sC6FmDFx9Rj8b31zpHYWkTmIh8cSfG5LOQ8QahNRqx7k4o2bPy KfcyBevYffPxC38JsRIm1keMyU6BziPXPk4jXS7gf+NOIvtUvuQjzhC2+eg9SpS6rmSW wChA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:message-id:date:to:from:delivered-to :arc-authentication-results; bh=S5GeIxUjduvbU/FSYluwe45N2n4bT5+/qVYFNTM8cf8=; b=mtp5cmnam0ID0xjvATWhzDefxvoMVtZSC7ARAy1vsoXrmCke6E0fd9Q6pT8tiDmfOB FkPxSBXzOlVP5RT8v/o3E+hK3iDjNmhwvAmd37ueLKSVF09GhKfx+pOiMxYGQfsMlSZM Hh+wzTQHrIBFoEx+XctSPDthStKJoYebDI7TU67G0dCQmN2q/zik3lS1WGzKbiXwjNg7 RjT8Z5bXVAjyFtN+qvpOpibJR+N74mNppIsT9IPgRjjCrsiuvT/h6jO4dYKc47k6/3sT MiZ9v9+DI1ej/bLUbxGSD2l6J9jPz7pR4fT14b+I85LpiDOey3lEvRWcc+ivSVQD50jQ taaw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id z72-v6si10098679wrb.25.2018.05.05.12.11.54; Sat, 05 May 2018 12:11:55 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 8106368A52A; Sat, 5 May 2018 22:11:18 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-qmta-pe01-3.mx.upcmail.net (vie01a-qmta-pe01-3.mx.upcmail.net [62.179.121.180]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 9958868A3AF for ; Sat, 5 May 2018 22:11:12 +0300 (EEST) Received: from [172.31.218.34] (helo=vie01a-dmta-pe02-1.mx.upcmail.net) by vie01a-pqmta-pe01.mx.upcmail.net with esmtp (Exim 4.88) (envelope-from ) id 1fF2ao-0005UX-HQ for ffmpeg-devel@ffmpeg.org; Sat, 05 May 2018 21:11:38 +0200 Received: from [172.31.216.43] (helo=vie01a-pemc-psmtp-pe01) by vie01a-dmta-pe02.mx.upcmail.net with esmtp (Exim 4.88) (envelope-from ) id 1fF2ah-0001Lc-8a for ffmpeg-devel@ffmpeg.org; Sat, 05 May 2018 21:11:31 +0200 Received: from localhost ([213.47.41.20]) by vie01a-pemc-psmtp-pe01 with SMTP @ mailcloud.upcmail.net id ijBT1x00F0S5wYM01jBU3C; Sat, 05 May 2018 21:11:28 +0200 X-SourceIP: 213.47.41.20 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sat, 5 May 2018 21:10:06 +0200 Message-Id: <20180505191006.12876-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.0 Subject: [FFmpeg-devel] [PATCH] avcodec/vp3: Check that there will be sufficient input for the coded fragments in unpack_superblocks() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: Timeout Fixes: 6292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP3_fuzzer-4871218218926080 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/vp3.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c index 1d83753314..fcc19a627b 100644 --- a/libavcodec/vp3.c +++ b/libavcodec/vp3.c @@ -543,7 +543,11 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb) : s->y_superblock_count); int num_coded_frags = 0; - for (i = sb_start; i < sb_end && get_bits_left(gb) > 0; i++) { + for (i = sb_start; i < sb_end; i++) { + if (get_bits_left(gb) < ((s->total_num_coded_frags + num_coded_frags) >> 2)) { + av_log(s->avctx, AV_LOG_ERROR, "Insufficient input data for coded fragments\n"); + return AVERROR_INVALIDDATA; + } /* iterate through all 16 fragments in a superblock */ for (j = 0; j < 16; j++) { /* if the fragment is in bounds, check its coding status */