diff mbox series

[FFmpeg-devel] avcodec/cri: Check for end of image in unpack_10bit()

Message ID 20201015155248.30957-1-michael@niedermayer.cc
State Accepted
Commit bc9686c85beb15cb87d492bfbea03c91d5317a11
Headers show
Series [FFmpeg-devel] avcodec/cri: Check for end of image in unpack_10bit() | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make warning Make failed

Commit Message

Michael Niedermayer Oct. 15, 2020, 3:52 p.m. UTC 
Fixes: out of array write
Fixes: 26242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5161495882891264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/cri.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

Comments

Michael Niedermayer Oct. 20, 2020, 1:36 p.m. UTC | #1 
On Thu, Oct 15, 2020 at 05:52:48PM +0200, Michael Niedermayer wrote:
> Fixes: out of array write
> Fixes: 26242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5161495882891264
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/cri.c | 18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)

will apply

[...]
diff mbox series

Patch

diff --git a/libavcodec/cri.c b/libavcodec/cri.c
index 3aad76a008..dafbc1f1be 100644
--- a/libavcodec/cri.c
+++ b/libavcodec/cri.c
@@ -87,54 +87,72 @@  static void unpack_10bit(GetByteContext *gb, uint16_t *dst, int shift,
         dst[pos] = (((a0 >> 1) & 0xE00) | (a0 & 0x1FF)) << shift;
         pos++;
         if (pos >= w) {
+            if (count == 1)
+                break;
             dst += stride;
             pos = 0;
         }
         dst[pos] = (((a0 >> 13) & 0x3F) | ((a0 >> 14) & 0xFC0)) << shift;
         pos++;
         if (pos >= w) {
+            if (count == 2)
+                break;
             dst += stride;
             pos = 0;
         }
         dst[pos] = (((a0 >> 26) & 7) | ((a1 & 0x1FF) << 3)) << shift;
         pos++;
         if (pos >= w) {
+            if (count == 3)
+                break;
             dst += stride;
             pos = 0;
         }
         dst[pos] = (((a1 >> 10) & 0x1FF) | ((a1 >> 11) & 0xE00)) << shift;
         pos++;
         if (pos >= w) {
+            if (count == 4)
+                break;
             dst += stride;
             pos = 0;
         }
         dst[pos] = (((a1 >> 23) & 0x3F) | ((a2 & 0x3F) << 6)) << shift;
         pos++;
         if (pos >= w) {
+            if (count == 5)
+                break;
             dst += stride;
             pos = 0;
         }
         dst[pos] = (((a2 >> 7) & 0xFF8) | ((a2 >> 6) & 7)) << shift;
         pos++;
         if (pos >= w) {
+            if (count == 6)
+                break;
             dst += stride;
             pos = 0;
         }
         dst[pos] = (((a3 & 7) << 9) | ((a2 >> 20) & 0x1FF)) << shift;
         pos++;
         if (pos >= w) {
+            if (count == 7)
+                break;
             dst += stride;
             pos = 0;
         }
         dst[pos] = (((a3 >> 4) & 0xFC0) | ((a3 >> 3) & 0x3F)) << shift;
         pos++;
         if (pos >= w) {
+            if (count == 8)
+                break;
             dst += stride;
             pos = 0;
         }
         dst[pos] = (((a3 >> 16) & 7) | ((a3 >> 17) & 0xFF8)) << shift;
         pos++;
         if (pos >= w) {
+            if (count == 9)
+                break;
             dst += stride;
             pos = 0;
         }