diff mbox series

[FFmpeg-devel,2/2] avcodec/gemdec: Check tag & planes before image allocation

Message ID 20211128185514.19253-2-michael@niedermayer.cc
State Accepted
Commit 6e34d947978867789ca563aaced26b166753b062
Headers show
Series None | expand

Commit Message

Michael Niedermayer Nov. 28, 2021, 6:55 p.m. UTC 
Fixes: Timeout
Fixes: 41083/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GEM_fuzzer-5843826518917120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/gemdec.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

Comments

Peter Ross Dec. 1, 2021, 5:15 a.m. UTC | #1 
On Sun, Nov 28, 2021 at 07:55:14PM +0100, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 41083/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GEM_fuzzer-5843826518917120
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/gemdec.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/libavcodec/gemdec.c b/libavcodec/gemdec.c
> index 2464dda8a7e..eee21a50d4b 100644
> --- a/libavcodec/gemdec.c
> +++ b/libavcodec/gemdec.c
> @@ -157,6 +157,14 @@ static int gem_decode_frame(AVCodecContext *avctx,
>      if (header_size >= 11)
>          tag = bytestream2_peek_be32(&gb);
>  
> +    if (tag == AV_RB32("STTT") || tag == AV_RB32("TIMG") || tag == AV_RB32("XIMG") ||
> +        planes == 1 || planes == 2 || planes == 3 || planes == 4 ||
> +        planes == 8 || planes == 16 || planes == 24) {
> +    } else {
> +        avpriv_request_sample(avctx, "planes=%d", planes);
> +        return AVERROR_PATCHWELCOME;
> +    }
> +
>      if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
>          return ret;
>  
> @@ -236,9 +244,6 @@ static int gem_decode_frame(AVCodecContext *avctx,
>          planes = 1;
>          row_width = avctx->width * pixel_size;
>          put_lines = put_lines_bytes;
> -    } else {
> -        avpriv_request_sample(avctx, "planes=%d", planes);
> -        return AVERROR_PATCHWELCOME;
>      }
>  
>      ret = av_reallocp_array(&avctx->priv_data, planes, row_width);

please apply

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
Michael Niedermayer Dec. 1, 2021, 4:29 p.m. UTC | #2 
On Wed, Dec 01, 2021 at 04:15:49PM +1100, Peter Ross wrote:
> On Sun, Nov 28, 2021 at 07:55:14PM +0100, Michael Niedermayer wrote:
> > Fixes: Timeout
> > Fixes: 41083/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GEM_fuzzer-5843826518917120
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/gemdec.c | 11 ++++++++---
> >  1 file changed, 8 insertions(+), 3 deletions(-)
> > 
> > diff --git a/libavcodec/gemdec.c b/libavcodec/gemdec.c
> > index 2464dda8a7e..eee21a50d4b 100644
> > --- a/libavcodec/gemdec.c
> > +++ b/libavcodec/gemdec.c
> > @@ -157,6 +157,14 @@ static int gem_decode_frame(AVCodecContext *avctx,
> >      if (header_size >= 11)
> >          tag = bytestream2_peek_be32(&gb);
> >  
> > +    if (tag == AV_RB32("STTT") || tag == AV_RB32("TIMG") || tag == AV_RB32("XIMG") ||
> > +        planes == 1 || planes == 2 || planes == 3 || planes == 4 ||
> > +        planes == 8 || planes == 16 || planes == 24) {
> > +    } else {
> > +        avpriv_request_sample(avctx, "planes=%d", planes);
> > +        return AVERROR_PATCHWELCOME;
> > +    }
> > +
> >      if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
> >          return ret;
> >  
> > @@ -236,9 +244,6 @@ static int gem_decode_frame(AVCodecContext *avctx,
> >          planes = 1;
> >          row_width = avctx->width * pixel_size;
> >          put_lines = put_lines_bytes;
> > -    } else {
> > -        avpriv_request_sample(avctx, "planes=%d", planes);
> > -        return AVERROR_PATCHWELCOME;
> >      }
> >  
> >      ret = av_reallocp_array(&avctx->priv_data, planes, row_width);
> 
> please apply

Will apply

thx

[...]
diff mbox series

Patch

diff --git a/libavcodec/gemdec.c b/libavcodec/gemdec.c
index 2464dda8a7e..eee21a50d4b 100644
--- a/libavcodec/gemdec.c
+++ b/libavcodec/gemdec.c
@@ -157,6 +157,14 @@  static int gem_decode_frame(AVCodecContext *avctx,
     if (header_size >= 11)
         tag = bytestream2_peek_be32(&gb);
 
+    if (tag == AV_RB32("STTT") || tag == AV_RB32("TIMG") || tag == AV_RB32("XIMG") ||
+        planes == 1 || planes == 2 || planes == 3 || planes == 4 ||
+        planes == 8 || planes == 16 || planes == 24) {
+    } else {
+        avpriv_request_sample(avctx, "planes=%d", planes);
+        return AVERROR_PATCHWELCOME;
+    }
+
     if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
         return ret;
 
@@ -236,9 +244,6 @@  static int gem_decode_frame(AVCodecContext *avctx,
         planes = 1;
         row_width = avctx->width * pixel_size;
         put_lines = put_lines_bytes;
-    } else {
-        avpriv_request_sample(avctx, "planes=%d", planes);
-        return AVERROR_PATCHWELCOME;
     }
 
     ret = av_reallocp_array(&avctx->priv_data, planes, row_width);