RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/vp6: clear dimensions on failed resolution change in vp6_parse_header() 

Fixes: 807/clusterfuzz-testcase-6470061042696192
Fixes null pointer dereference

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 967feea5eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-03-12 03:04:06 +01:00
parent 74e8d58f5b
commit 4c74a38193
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/vp6.c
View File

@ -108,7 +108,7 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
ret = ff_vp56_init_range_decoder(c, buf+6, buf_size-6);
if (ret < 0)
return ret;
goto fail;
vp56_rac_gets(c, 2);
parse_filter_info = s->filter_header;
@ -162,9 +162,8 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
buf += coeff_offset;
buf_size -= coeff_offset;
if (buf_size < 0) {
if (s->frames[VP56_FRAME_CURRENT]->key_frame)
ff_set_dimensions(s->avctx, 0, 0);
return AVERROR_INVALIDDATA;
ret = AVERROR_INVALIDDATA;
goto fail;
}
if (s->use_huffman) {
s->parse_coeff = vp6_parse_coeff_huffman;
@ -172,7 +171,7 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
} else {
ret = ff_vp56_init_range_decoder(&s->cc, buf, buf_size);
if (ret < 0)
return ret;
goto fail;
s->ccp = &s->cc;
}
} else {
@ -180,6 +179,10 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
}
return res;
fail:
if (res == VP56_SIZE_CHANGE)
ff_set_dimensions(s->avctx, 0, 0);
return ret;
}
static void vp6_coeff_order_table_init(VP56Context *s)