| Message ID | 20190726162608.22708-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 38b6c48c4300343f4703019a90a332773e64e11b |
| Headers | show |
I guess it is fine. On Fri, Jul 26, 2019 at 6:28 PM Michael Niedermayer <michael@niedermayer.cc> wrote: > An incomplete image is not supported prior to this and will > not produce any output. This commit moves the failure before > time consuming operations. > > Fixes: Timeout (81sec -> 76ms) > Fixes: > 15723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BRENDER_PIX_fuzzer-5147265653538816 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by > <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>: > Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/brenderpix.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/libavcodec/brenderpix.c b/libavcodec/brenderpix.c > index 0556858de1..46b7a59aa4 100644 > --- a/libavcodec/brenderpix.c > +++ b/libavcodec/brenderpix.c > @@ -204,6 +204,10 @@ static int pix_decode_frame(AVCodecContext *avctx, > void *data, int *got_frame, > avpriv_request_sample(avctx, "Format %d", hdr.format); > return AVERROR_PATCHWELCOME; > } > + bytes_per_scanline = bytes_pp * hdr.width; > + > + if (bytestream2_get_bytes_left(&gb) < hdr.height * bytes_per_scanline) > + return AVERROR_INVALIDDATA; > > if ((ret = ff_set_dimensions(avctx, hdr.width, hdr.height)) < 0) > return ret; > @@ -261,7 +265,6 @@ static int pix_decode_frame(AVCodecContext *avctx, > void *data, int *got_frame, > bytestream2_skip(&gb, 8); > > // read the image data to the buffer > - bytes_per_scanline = bytes_pp * hdr.width; > bytes_left = bytestream2_get_bytes_left(&gb); > > if (chunk_type != IMAGE_DATA_CHUNK || data_len != bytes_left || > -- > 2.22.0 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
On Fri, Jul 26, 2019 at 07:46:10PM +0200, Paul B Mahol wrote:
> I guess it is fine.
will apply
thanks
[...]
diff --git a/libavcodec/brenderpix.c b/libavcodec/brenderpix.c index 0556858de1..46b7a59aa4 100644 --- a/libavcodec/brenderpix.c +++ b/libavcodec/brenderpix.c @@ -204,6 +204,10 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, avpriv_request_sample(avctx, "Format %d", hdr.format); return AVERROR_PATCHWELCOME; } + bytes_per_scanline = bytes_pp * hdr.width; + + if (bytestream2_get_bytes_left(&gb) < hdr.height * bytes_per_scanline) + return AVERROR_INVALIDDATA; if ((ret = ff_set_dimensions(avctx, hdr.width, hdr.height)) < 0) return ret; @@ -261,7 +265,6 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, bytestream2_skip(&gb, 8); // read the image data to the buffer - bytes_per_scanline = bytes_pp * hdr.width; bytes_left = bytestream2_get_bytes_left(&gb); if (chunk_type != IMAGE_DATA_CHUNK || data_len != bytes_left ||
An incomplete image is not supported prior to this and will not produce any output. This commit moves the failure before time consuming operations. Fixes: Timeout (81sec -> 76ms) Fixes: 15723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BRENDER_PIX_fuzzer-5147265653538816 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/brenderpix.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)