RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/targaenc: Allocate space for the palette 

Fixes: out of array access
Fixes: 68927/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5105665067515904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-06-16 19:33:02 +02:00
parent d34d4b6a7c
commit 4a7220bd5c
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/targaenc.c
View File

@ -21,6 +21,7 @@
#include <string.h> #include <string.h>
#include "libavutil/avassert.h"
#include "libavutil/imgutils.h" #include "libavutil/imgutils.h"
#include "libavutil/internal.h" #include "libavutil/internal.h"
#include "libavutil/intreadwrite.h" #include "libavutil/intreadwrite.h"
@ -89,10 +90,11 @@ static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
TargaContext *s = avctx->priv_data; TargaContext *s = avctx->priv_data;
int bpp, picsize, datasize = -1, ret, i; int bpp, picsize, datasize = -1, ret, i;
uint8_t *out; uint8_t *out;
int maxpal = 32*32;
picsize = av_image_get_buffer_size(avctx->pix_fmt, picsize = av_image_get_buffer_size(avctx->pix_fmt,
avctx->width, avctx->height, 1); avctx->width, avctx->height, 1);
if ((ret = ff_alloc_packet(avctx, pkt, picsize + 45)) < 0) if ((ret = ff_alloc_packet(avctx, pkt, picsize + 45 + maxpal)) < 0)
return ret; return ret;
/* zero out the header and only set applicable fields */ /* zero out the header and only set applicable fields */
@ -125,6 +127,7 @@ static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
AV_WL24(pkt->data + 18 + 3 * i, *(uint32_t *)(p->data[1] + i * 4)); AV_WL24(pkt->data + 18 + 3 * i, *(uint32_t *)(p->data[1] + i * 4));
} }
out += 32 * pal_bpp; /* skip past the palette we just output */ out += 32 * pal_bpp; /* skip past the palette we just output */
av_assert0(32 * pal_bpp <= maxpal);
break; break;
} }
case AV_PIX_FMT_GRAY8: case AV_PIX_FMT_GRAY8: