RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/ivi: Use av_image_check_size2() 

Fixes OOM
Fixes: 1514/clusterfuzz-testcase-minimized-6437666243477504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-07-12 20:31:24 +02:00
parent 341f01290c
commit a824685140
4 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/indeo4.c
View File

@ -187,7 +187,7 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
/* check if picture layout was changed and reallocate buffers */ /* check if picture layout was changed and reallocate buffers */
if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf)) { if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf)) {
if (ff_ivi_init_planes(ctx->planes, &pic_conf, 1)) { if (ff_ivi_init_planes(avctx, ctx->planes, &pic_conf, 1)) {
av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n"); av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n");
ctx->pic_conf.luma_bands = 0; ctx->pic_conf.luma_bands = 0;
return AVERROR(ENOMEM); return AVERROR(ENOMEM);

4
libavcodec/indeo5.c
View File

@ -113,7 +113,7 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
/* check if picture layout was changed and reallocate buffers */ /* check if picture layout was changed and reallocate buffers */
if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf) || ctx->gop_invalid) { if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf) || ctx->gop_invalid) {
result = ff_ivi_init_planes(ctx->planes, &pic_conf, 0); result = ff_ivi_init_planes(avctx, ctx->planes, &pic_conf, 0);
if (result < 0) { if (result < 0) {
av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n"); av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n");
return result; return result;
@ -657,7 +657,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
ctx->pic_conf.tile_height = avctx->height; ctx->pic_conf.tile_height = avctx->height;
ctx->pic_conf.luma_bands = ctx->pic_conf.chroma_bands = 1; ctx->pic_conf.luma_bands = ctx->pic_conf.chroma_bands = 1;
result = ff_ivi_init_planes(ctx->planes, &ctx->pic_conf, 0); result = ff_ivi_init_planes(avctx, ctx->planes, &ctx->pic_conf, 0);
if (result) { if (result) {
av_log(avctx, AV_LOG_ERROR, "Couldn't allocate color planes!\n"); av_log(avctx, AV_LOG_ERROR, "Couldn't allocate color planes!\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;

4
libavcodec/ivi.c
View File

@ -302,7 +302,7 @@ static av_cold void ivi_free_buffers(IVIPlaneDesc *planes)
} }
} }
av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg, av_cold int ff_ivi_init_planes(AVCodecContext *avctx, IVIPlaneDesc *planes, const IVIPicConfig *cfg,
int is_indeo4) int is_indeo4)
{ {
int p, b; int p, b;
@ -312,7 +312,7 @@ av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg,
ivi_free_buffers(planes); ivi_free_buffers(planes);
if (av_image_check_size(cfg->pic_width, cfg->pic_height, 0, NULL) < 0 || if (av_image_check_size2(cfg->pic_width, cfg->pic_height, avctx->max_pixels, AV_PIX_FMT_YUV410P, 0, avctx) < 0 ||
cfg->luma_bands < 1 || cfg->chroma_bands < 1) cfg->luma_bands < 1 || cfg->chroma_bands < 1)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;

4
libavcodec/ivi.h
View File

@ -322,8 +322,8 @@ int ff_ivi_dec_huff_desc(GetBitContext *gb, int desc_coded, int which_tab,
* @param[in] is_indeo4 flag signalling if it is Indeo 4 or not * @param[in] is_indeo4 flag signalling if it is Indeo 4 or not
* @return result code: 0 - OK * @return result code: 0 - OK
*/ */
int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg, int ff_ivi_init_planes(AVCodecContext *avctx, IVIPlaneDesc *planes,
int is_indeo4); const IVIPicConfig *cfg, int is_indeo4);
/** /**
* Initialize tile and macroblock descriptors. * Initialize tile and macroblock descriptors.