| Message ID | 20220722065550.5431-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 76112c2b4167bb3c40503b3334c8b38fd707a8d5 |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avcodec/tiff: Check tile_length and tile_width | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Fri, Jul 22, 2022 at 08:55:49AM +0200, Michael Niedermayer wrote: > Fixes: Division by 0 > Fixes: 49235/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5495613847896064 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/tiff.c | 3 +++ > 1 file changed, 3 insertions(+) will apply and backport patchset [...]
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 349df14035..329eafe494 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -965,6 +965,9 @@ static int dng_decode_tiles(AVCodecContext *avctx, AVFrame *frame, int pos_x = 0, pos_y = 0; int ret; + if (s->tile_width <= 0 || s->tile_length <= 0) + return AVERROR_INVALIDDATA; + has_width_leftover = (s->width % s->tile_width != 0); has_height_leftover = (s->height % s->tile_length != 0);
Fixes: Division by 0 Fixes: 49235/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5495613847896064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/tiff.c | 3 +++ 1 file changed, 3 insertions(+)