diff mbox series

[FFmpeg-devel,1/9] avcodec/targaenc: Allocate space for the palette

Message ID 20240616230831.912377-1-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/9] avcodec/targaenc: Allocate space for the palette | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished

Commit Message

Michael Niedermayer June 16, 2024, 11:08 p.m. UTC 
Fixes: out of array access
Fixes: 68927/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5105665067515904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/targaenc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Michael Niedermayer June 25, 2024, 7:55 p.m. UTC | #1 
On Mon, Jun 17, 2024 at 01:08:23AM +0200, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: 68927/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5105665067515904
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/targaenc.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

will apply

[...]
diff mbox series

Patch

diff --git a/libavcodec/targaenc.c b/libavcodec/targaenc.c
index d9c500b97de..8f496c62bd9 100644
--- a/libavcodec/targaenc.c
+++ b/libavcodec/targaenc.c
@@ -21,6 +21,7 @@ 
 
 #include <string.h>
 
+#include "libavutil/avassert.h"
 #include "libavutil/imgutils.h"
 #include "libavutil/internal.h"
 #include "libavutil/intreadwrite.h"
@@ -89,10 +90,11 @@  static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
     TargaContext *s = avctx->priv_data;
     int bpp, picsize, datasize = -1, ret, i;
     uint8_t *out;
+    int maxpal = 32*32;
 
     picsize = av_image_get_buffer_size(avctx->pix_fmt,
                                        avctx->width, avctx->height, 1);
-    if ((ret = ff_alloc_packet(avctx, pkt, picsize + 45)) < 0)
+    if ((ret = ff_alloc_packet(avctx, pkt, picsize + 45 + maxpal)) < 0)
         return ret;
 
     /* zero out the header and only set applicable fields */
@@ -125,6 +127,7 @@  static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
             AV_WL24(pkt->data + 18 + 3 * i, *(uint32_t *)(p->data[1] + i * 4));
             }
         out += 32 * pal_bpp;        /* skip past the palette we just output */
+        av_assert0(32 * pal_bpp <= maxpal);
         break;
         }
     case AV_PIX_FMT_GRAY8: