diff mbox series

[FFmpeg-devel,3/4] avcodec/mobiclip: Check input size before (re)allocation

Message ID 20221118210918.3169-3-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/4] avcodec/tiff: Ignore tile_count | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 fail Make fate failed
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Nov. 18, 2022, 9:09 p.m. UTC
Fixes: Timeout
Fixes: 52566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-4913160050311168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/mobiclip.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Shiyou Yin Nov. 19, 2022, 2:34 a.m. UTC | #1
Please ignore fail info form loongarch64 patchwork temporarily.
I have stoped the service from Nov 16th, but there are still result post to patchwork.
Have mailed to Andriy to help analyze this problem together.

> 2022年11月19日 05:09,Michael Niedermayer <michael@niedermayer.cc> 写道:
> 
> Fixes: Timeout
> Fixes: 52566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-4913160050311168
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavcodec/mobiclip.c | 3 +++
> 1 file changed, 3 insertions(+)
> 
> diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c
> index aca462428c..c3b2383dbc 100644
> --- a/libavcodec/mobiclip.c
> +++ b/libavcodec/mobiclip.c
> @@ -1216,6 +1216,9 @@ static int mobiclip_decode(AVCodecContext *avctx, AVFrame *rframe,
>     AVFrame *frame = s->pic[s->current_pic];
>     int ret;
> 
> +    if (avctx->height/16 * (avctx->width/16) * 2 > 8LL*FFALIGN(pkt->size, 2))
> +        return AVERROR_INVALIDDATA;
> +
>     av_fast_padded_malloc(&s->bitstream, &s->bitstream_size,
>                           pkt->size);
> 
> -- 
> 2.17.1
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
diff mbox series

Patch

diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c
index aca462428c..c3b2383dbc 100644
--- a/libavcodec/mobiclip.c
+++ b/libavcodec/mobiclip.c
@@ -1216,6 +1216,9 @@  static int mobiclip_decode(AVCodecContext *avctx, AVFrame *rframe,
     AVFrame *frame = s->pic[s->current_pic];
     int ret;
 
+    if (avctx->height/16 * (avctx->width/16) * 2 > 8LL*FFALIGN(pkt->size, 2))
+        return AVERROR_INVALIDDATA;
+
     av_fast_padded_malloc(&s->bitstream, &s->bitstream_size,
                           pkt->size);