RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/pngdec: Check amount decoded 

Fixes: Timeout (70sec -> 243ms)
Fixes: 16097/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5664690889293824
Fixes: 16927/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5170612070252544
Fixes: 16927/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5706325622784000
Fixes: 18705/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5650989302677504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-08-17 23:55:34 +02:00
parent eb64a5c6f9
commit 861183f2e6
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/pngdec.c
View File

@ -320,6 +320,15 @@ static void deloco_ ## NAME(TYPE *dst, int size, int alpha) \
YUV2RGB(rgb8, uint8_t)
YUV2RGB(rgb16, uint16_t)
static int percent_missing(PNGDecContext *s)
{
if (s->interlace_type) {
return 100 - 100 * s->pass / (NB_PASSES - 1);
} else {
return 100 - 100 * s->y / s->cur_h;
}
}
/* process exactly one decompressed row */
static void png_handle_row(PNGDecContext *s)
{
@ -1354,6 +1363,9 @@ exit_loop:
return 0;
}
if (percent_missing(s) > avctx->discard_damaged_percentage)
return AVERROR_INVALIDDATA;
if (s->bits_per_pixel <= 4)
handle_small_bpp(s, p);