diff mbox series

[FFmpeg-devel,3/6] avcodec/pngdec: dont skip/read chunk twice

Message ID 20230111235432.2135-3-michael@niedermayer.cc
State Accepted
Commit df1a38d5200e14a29903f1027b4548d595c7ff8a
Headers show
Series [FFmpeg-devel,1/6] avcodec/eatgq: : Check index increments in tgq_decode_block() | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Jan. 11, 2023, 11:54 p.m. UTC 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-6668158952144896.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/pngdec.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Michael Niedermayer Feb. 23, 2023, 10:22 p.m. UTC | #1 
On Thu, Jan 12, 2023 at 12:54:29AM +0100, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-6668158952144896.fuzz
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/pngdec.c | 1 +
>  1 file changed, 1 insertion(+)

will apply

[...]
diff mbox series

Patch

diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index cb4162d2ab..95bcfb514a 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -1231,6 +1231,7 @@  static int decode_frame_common(AVCodecContext *avctx, PNGDecContext *s,
                 }
                 av_log(avctx, AV_LOG_ERROR, ", skipping\n");
                 bytestream2_skip(&s->gb, length + 8); /* tag */
+                continue;
             }
         }
         tag = bytestream2_get_le32(&s->gb);