RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/flicvideo: Check frame_size before decrementing 

Fixes: runtime error: signed integer overflow: -2147483627 - 22 cannot be represented in type 'int'
Fixes: 1637/clusterfuzz-testcase-minimized-5376582493405184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-17 01:12:55 +02:00
parent 552adf1dd3
commit 355e27e24d
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/flicvideo.c
View File

@ -199,6 +199,9 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
num_chunks = bytestream2_get_le16(&g2); num_chunks = bytestream2_get_le16(&g2);
bytestream2_skip(&g2, 8); /* skip padding */ bytestream2_skip(&g2, 8); /* skip padding */
if (frame_size < 16)
return AVERROR_INVALIDDATA;
frame_size -= 16; frame_size -= 16;
/* iterate through the chunks */ /* iterate through the chunks */
@ -523,6 +526,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
if (frame_size > buf_size) if (frame_size > buf_size)
frame_size = buf_size; frame_size = buf_size;
if (frame_size < 16)
return AVERROR_INVALIDDATA;
frame_size -= 16; frame_size -= 16;
/* iterate through the chunks */ /* iterate through the chunks */
@ -815,6 +820,8 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
if (frame_size > buf_size) if (frame_size > buf_size)
frame_size = buf_size; frame_size = buf_size;
if (frame_size < 16)
return AVERROR_INVALIDDATA;
frame_size -= 16; frame_size -= 16;
/* iterate through the chunks */ /* iterate through the chunks */