diff mbox series

[FFmpeg-devel,2/2] avcodec/mpeg4videodec: Check pixel size against packet size

Message ID 20220429182410.5044-2-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/2] avcodec/alacdsp: Make intermediates unsigned | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished
andriy/make_armv7_RPi4 success Make finished
andriy/make_fate_armv7_RPi4 success Make fate finished

Commit Message

Michael Niedermayer April 29, 2022, 6:24 p.m. UTC 
Fixes: Timeout
Fixes: 46866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5114397204283392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/mpeg4videodec.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index e2bde73639..267a79a62f 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -2337,8 +2337,14 @@  static int decode_studio_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
         /* Do the same check as non-studio profile */
         if (width && height) {
             if (s->width && s->height &&
-                (s->width != width || s->height != height))
+                (s->width != width || s->height != height)) {
+                if (width*height / 256 > get_bits_left(gb)) {
+                    av_log(s->avctx, AV_LOG_ERROR, "Impossible size for this frame\n");
+                    return AVERROR_INVALIDDATA;
+                }
+
                 s->context_reinit = 1;
+            }
             s->width  = width;
             s->height = height;
         }
@@ -2485,8 +2491,13 @@  static int decode_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
             if (width && height &&  /* they should be non zero but who knows */
                 !(s->width && s->codec_tag == AV_RL32("MP4S"))) {
                 if (s->width && s->height &&
-                    (s->width != width || s->height != height))
+                    (s->width != width || s->height != height)) {
+                    if (width*height/256 > get_bits_left(gb)) {
+                        av_log(s->avctx, AV_LOG_ERROR, "Impossible size for this frame\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     s->context_reinit = 1;
+                }
                 s->width  = width;
                 s->height = height;
             }