RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/targa: Check colors vs. available space 

Fixes: Timeout (37sec -> 52ms)
Fixes: 18892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5739537854889984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-11-21 22:43:01 +01:00
parent 5a8877da35
commit 01593278ce
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/targa.c
View File

@ -132,12 +132,6 @@ static int decode_frame(AVCodecContext *avctx,
h = bytestream2_get_le16(&s->gb); h = bytestream2_get_le16(&s->gb);
bpp = bytestream2_get_byte(&s->gb); bpp = bytestream2_get_byte(&s->gb);
if (bytestream2_get_bytes_left(&s->gb) <= idlen) {
av_log(avctx, AV_LOG_ERROR,
"Not enough data to read header\n");
return AVERROR_INVALIDDATA;
}
flags = bytestream2_get_byte(&s->gb); flags = bytestream2_get_byte(&s->gb);
if (!pal && (first_clr || colors || csize)) { if (!pal && (first_clr || colors || csize)) {
@ -146,6 +140,12 @@ static int decode_frame(AVCodecContext *avctx,
first_clr = colors = csize = 0; first_clr = colors = csize = 0;
} }
if (bytestream2_get_bytes_left(&s->gb) < idlen + 2*colors) {
av_log(avctx, AV_LOG_ERROR,
"Not enough data to read header\n");
return AVERROR_INVALIDDATA;
}
// skip identifier if any // skip identifier if any
bytestream2_skip(&s->gb, idlen); bytestream2_skip(&s->gb, idlen);