| Message ID | 20211223211527.20408-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 68f8292aa96d99b733ca7d2e56b584b00263db84 |
| Headers | show |
| Series | [FFmpeg-devel,1/5] avcodec/targa: Check input size for uncompressed TGA before allocation | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
| andriy/make_ppc | success | Make finished |
| andriy/make_fate_ppc | fail | Make fate failed |
On Thu, Dec 23, 2021 at 10:15:23PM +0100, Michael Niedermayer wrote: > Fixes: Timeout > Fixes: 42667/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5619236075077632 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/targa.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) will apply [...]
diff --git a/libavcodec/targa.c b/libavcodec/targa.c index 221fcc956d0..b0048621d35 100644 --- a/libavcodec/targa.c +++ b/libavcodec/targa.c @@ -117,6 +117,7 @@ static int decode_frame(AVCodecContext *avctx, int idlen, pal, compr, y, w, h, bpp, flags, ret; int first_clr, colors, csize; int interleave; + size_t img_size; bytestream2_init(&s->gb, avpkt->data, avpkt->size); @@ -180,6 +181,15 @@ static int decode_frame(AVCodecContext *avctx, return avpkt->size; } + if (!(compr & TGA_RLE)) { + img_size = w * ((bpp + 1) >> 3); + if (bytestream2_get_bytes_left(&s->gb) < img_size * h) { + av_log(avctx, AV_LOG_ERROR, + "Not enough data available for image\n"); + return AVERROR_INVALIDDATA; + } + } + if ((ret = ff_get_buffer(avctx, p, 0)) < 0) return ret; p->pict_type = AV_PICTURE_TYPE_I; @@ -251,7 +261,6 @@ static int decode_frame(AVCodecContext *avctx, if (res < 0) return res; } else { - size_t img_size = w * ((bpp + 1) >> 3); uint8_t *line; if (bytestream2_get_bytes_left(&s->gb) < img_size * h) { av_log(avctx, AV_LOG_ERROR,
Fixes: Timeout Fixes: 42667/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5619236075077632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/targa.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)