RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/ivi: Use av_image_check_size2() 

Fixes OOM
Fixes: 1514/clusterfuzz-testcase-minimized-6437666243477504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-07-12 20:31:24 +02:00
parent 341f01290c
commit a824685140
4 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/indeo4.c
View File

@ -187,7 +187,7 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
/* check if picture layout was changed and reallocate buffers */
if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf)) {
if (ff_ivi_init_planes(ctx->planes, &pic_conf, 1)) {
if (ff_ivi_init_planes(avctx, ctx->planes, &pic_conf, 1)) {
av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n");
ctx->pic_conf.luma_bands = 0;
return AVERROR(ENOMEM);

4
libavcodec/indeo5.c
View File

@ -113,7 +113,7 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
/* check if picture layout was changed and reallocate buffers */
if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf) || ctx->gop_invalid) {
result = ff_ivi_init_planes(ctx->planes, &pic_conf, 0);
result = ff_ivi_init_planes(avctx, ctx->planes, &pic_conf, 0);
if (result < 0) {
av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n");
return result;
@ -657,7 +657,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
ctx->pic_conf.tile_height = avctx->height;
ctx->pic_conf.luma_bands = ctx->pic_conf.chroma_bands = 1;
result = ff_ivi_init_planes(ctx->planes, &ctx->pic_conf, 0);
result = ff_ivi_init_planes(avctx, ctx->planes, &ctx->pic_conf, 0);
if (result) {
av_log(avctx, AV_LOG_ERROR, "Couldn't allocate color planes!\n");
return AVERROR_INVALIDDATA;

4
libavcodec/ivi.c
View File

@ -302,7 +302,7 @@ static av_cold void ivi_free_buffers(IVIPlaneDesc *planes)
}
}
av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg,
av_cold int ff_ivi_init_planes(AVCodecContext *avctx, IVIPlaneDesc *planes, const IVIPicConfig *cfg,
int is_indeo4)
{
int p, b;
@ -312,7 +312,7 @@ av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg,
ivi_free_buffers(planes);
if (av_image_check_size(cfg->pic_width, cfg->pic_height, 0, NULL) < 0 ||
if (av_image_check_size2(cfg->pic_width, cfg->pic_height, avctx->max_pixels, AV_PIX_FMT_YUV410P, 0, avctx) < 0 ||
cfg->luma_bands < 1 || cfg->chroma_bands < 1)
return AVERROR_INVALIDDATA;

4
libavcodec/ivi.h
View File

@ -322,8 +322,8 @@ int ff_ivi_dec_huff_desc(GetBitContext *gb, int desc_coded, int which_tab,
* @param[in] is_indeo4 flag signalling if it is Indeo 4 or not
* @return result code: 0 - OK
*/
int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg,
int is_indeo4);
int ff_ivi_init_planes(AVCodecContext *avctx, IVIPlaneDesc *planes,
const IVIPicConfig *cfg, int is_indeo4);
/**
* Initialize tile and macroblock descriptors.