| Message ID | 20190425171808.32133-1-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
On 4/25/19, Michael Niedermayer <michael@niedermayer.cc> wrote: > Fixes: Timeout (22sec -> 11sec) > Fixes: > 13576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5681024577568768 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/gdv.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/gdv.c b/libavcodec/gdv.c > index 183286b55f..0c16ad850a 100644 > --- a/libavcodec/gdv.c > +++ b/libavcodec/gdv.c > @@ -475,15 +475,14 @@ static int gdv_decode_frame(AVCodecContext *avctx, > void *data, > if (pal && pal_size == AVPALETTE_SIZE) > memcpy(gdv->pal, pal, AVPALETTE_SIZE); > > + if (compression < 2 && bytestream2_get_bytes_left(gb) < 256*3) > + return AVERROR_INVALIDDATA; > rescale(gdv, gdv->frame, avctx->width, avctx->height, > !!(flags & 0x10), !!(flags & 0x20)); > - Unrelated. > switch (compression) { > case 1: > memset(gdv->frame + PREAMBLE_SIZE, 0, gdv->frame_size - > PREAMBLE_SIZE); > case 0: > - if (bytestream2_get_bytes_left(gb) < 256*3) > - return AVERROR_INVALIDDATA; > for (i = 0; i < 256; i++) { > unsigned r = bytestream2_get_byte(gb); > unsigned g = bytestream2_get_byte(gb); > -- > 2.21.0 Otherwise ok.
On Thu, Apr 25, 2019 at 07:39:52PM +0200, Paul B Mahol wrote: > On 4/25/19, Michael Niedermayer <michael@niedermayer.cc> wrote: > > Fixes: Timeout (22sec -> 11sec) > > Fixes: > > 13576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5681024577568768 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/gdv.c | 5 ++--- > > 1 file changed, 2 insertions(+), 3 deletions(-) > > > > diff --git a/libavcodec/gdv.c b/libavcodec/gdv.c > > index 183286b55f..0c16ad850a 100644 > > --- a/libavcodec/gdv.c > > +++ b/libavcodec/gdv.c > > @@ -475,15 +475,14 @@ static int gdv_decode_frame(AVCodecContext *avctx, > > void *data, > > if (pal && pal_size == AVPALETTE_SIZE) > > memcpy(gdv->pal, pal, AVPALETTE_SIZE); > > > > + if (compression < 2 && bytestream2_get_bytes_left(gb) < 256*3) > > + return AVERROR_INVALIDDATA; > > rescale(gdv, gdv->frame, avctx->width, avctx->height, > > !!(flags & 0x10), !!(flags & 0x20)); > > - > > Unrelated. removed > > > switch (compression) { > > case 1: > > memset(gdv->frame + PREAMBLE_SIZE, 0, gdv->frame_size - > > PREAMBLE_SIZE); > > case 0: > > - if (bytestream2_get_bytes_left(gb) < 256*3) > > - return AVERROR_INVALIDDATA; > > for (i = 0; i < 256; i++) { > > unsigned r = bytestream2_get_byte(gb); > > unsigned g = bytestream2_get_byte(gb); > > -- > > 2.21.0 > > Otherwise ok. will apply thx [...]
diff --git a/libavcodec/gdv.c b/libavcodec/gdv.c index 183286b55f..0c16ad850a 100644 --- a/libavcodec/gdv.c +++ b/libavcodec/gdv.c @@ -475,15 +475,14 @@ static int gdv_decode_frame(AVCodecContext *avctx, void *data, if (pal && pal_size == AVPALETTE_SIZE) memcpy(gdv->pal, pal, AVPALETTE_SIZE); + if (compression < 2 && bytestream2_get_bytes_left(gb) < 256*3) + return AVERROR_INVALIDDATA; rescale(gdv, gdv->frame, avctx->width, avctx->height, !!(flags & 0x10), !!(flags & 0x20)); - switch (compression) { case 1: memset(gdv->frame + PREAMBLE_SIZE, 0, gdv->frame_size - PREAMBLE_SIZE); case 0: - if (bytestream2_get_bytes_left(gb) < 256*3) - return AVERROR_INVALIDDATA; for (i = 0; i < 256; i++) { unsigned r = bytestream2_get_byte(gb); unsigned g = bytestream2_get_byte(gb);
Fixes: Timeout (22sec -> 11sec) Fixes: 13576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5681024577568768 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/gdv.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)