@@ -2337,8 +2337,14 @@ static int decode_studio_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
/* Do the same check as non-studio profile */
if (width && height) {
if (s->width && s->height &&
- (s->width != width || s->height != height))
+ (s->width != width || s->height != height)) {
+ if (width*height / 256 > get_bits_left(gb)) {
+ av_log(s->avctx, AV_LOG_ERROR, "Impossible size for this frame\n");
+ return AVERROR_INVALIDDATA;
+ }
+
s->context_reinit = 1;
+ }
s->width = width;
s->height = height;
}
@@ -2485,8 +2491,13 @@ static int decode_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
if (width && height && /* they should be non zero but who knows */
!(s->width && s->codec_tag == AV_RL32("MP4S"))) {
if (s->width && s->height &&
- (s->width != width || s->height != height))
+ (s->width != width || s->height != height)) {
+ if (width*height/256 > get_bits_left(gb)) {
+ av_log(s->avctx, AV_LOG_ERROR, "Impossible size for this frame\n");
+ return AVERROR_INVALIDDATA;
+ }
s->context_reinit = 1;
+ }
s->width = width;
s->height = height;
}
Fixes: Timeout Fixes: 46866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5114397204283392 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/mpeg4videodec.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)