diff mbox series

[FFmpeg-devel,2/6] Execure whole size check earlier for rv20

Message ID 20210410222446.3012-2-michael@niedermayer.cc
State Accepted
Commit f8556b632f4b29e54067ecba6f71ceb8af3806e4
Headers show
Series [FFmpeg-devel,1/6] avformat/cafdec: Check channels
Related show

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Michael Niedermayer April 10, 2021, 10:24 p.m. UTC
Fixes: Timeout
Fixes: 31380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5230899257016320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/rv10.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

Andreas Rheinhardt April 20, 2021, 2:48 p.m. UTC | #1
Michael Niedermayer:
> Fixes: Timeout
> Fixes: 31380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5230899257016320
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/rv10.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c
> index bd70689cab..9c3a48c251 100644
> --- a/libavcodec/rv10.c
> +++ b/libavcodec/rv10.c
> @@ -154,7 +154,7 @@ static int rv10_decode_picture_header(MpegEncContext *s)
>      return mb_count;
>  }
>  
> -static int rv20_decode_picture_header(RVDecContext *rv)
> +static int rv20_decode_picture_header(RVDecContext *rv, int whole_size)
>  {
>      MpegEncContext *s = &rv->m;
>      int seq, mb_pos, i, ret;
> @@ -232,6 +232,10 @@ static int rv20_decode_picture_header(RVDecContext *rv)
>                     "attempting to change resolution to %dx%d\n", new_w, new_h);
>              if (av_image_check_size(new_w, new_h, 0, s->avctx) < 0)
>                  return AVERROR_INVALIDDATA;
> +
> +            if (whole_size < (new_w + 15)/16 * ((new_h + 15)/16) / 8)
> +                return AVERROR_INVALIDDATA;
> +
>              ff_mpv_common_end(s);
>  
>              // attempt to keep aspect during typical resolution switches
> @@ -447,7 +451,7 @@ static int rv10_decode_packet(AVCodecContext *avctx, const uint8_t *buf,
>      if (s->codec_id == AV_CODEC_ID_RV10)
>          mb_count = rv10_decode_picture_header(s);
>      else
> -        mb_count = rv20_decode_picture_header(rv);
> +        mb_count = rv20_decode_picture_header(rv, whole_size);
>      if (mb_count < 0) {
>          if (mb_count != ERROR_SKIP_FRAME)
>              av_log(s->avctx, AV_LOG_ERROR, "HEADER ERROR\n");
> 
Typo: Execute.

- Andreas
diff mbox series

Patch

diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c
index bd70689cab..9c3a48c251 100644
--- a/libavcodec/rv10.c
+++ b/libavcodec/rv10.c
@@ -154,7 +154,7 @@  static int rv10_decode_picture_header(MpegEncContext *s)
     return mb_count;
 }
 
-static int rv20_decode_picture_header(RVDecContext *rv)
+static int rv20_decode_picture_header(RVDecContext *rv, int whole_size)
 {
     MpegEncContext *s = &rv->m;
     int seq, mb_pos, i, ret;
@@ -232,6 +232,10 @@  static int rv20_decode_picture_header(RVDecContext *rv)
                    "attempting to change resolution to %dx%d\n", new_w, new_h);
             if (av_image_check_size(new_w, new_h, 0, s->avctx) < 0)
                 return AVERROR_INVALIDDATA;
+
+            if (whole_size < (new_w + 15)/16 * ((new_h + 15)/16) / 8)
+                return AVERROR_INVALIDDATA;
+
             ff_mpv_common_end(s);
 
             // attempt to keep aspect during typical resolution switches
@@ -447,7 +451,7 @@  static int rv10_decode_packet(AVCodecContext *avctx, const uint8_t *buf,
     if (s->codec_id == AV_CODEC_ID_RV10)
         mb_count = rv10_decode_picture_header(s);
     else
-        mb_count = rv20_decode_picture_header(rv);
+        mb_count = rv20_decode_picture_header(rv, whole_size);
     if (mb_count < 0) {
         if (mb_count != ERROR_SKIP_FRAME)
             av_log(s->avctx, AV_LOG_ERROR, "HEADER ERROR\n");