RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-02-17 04:17:05 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()

Browse Source 
Fixes: Timeout (31sec -> 41ms)
Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 32b3c8ce7d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-10-23 23:31:03 +02:00
parent 3613a0df40
commit 571c66659d
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/iff.c
View File

@ -1143,6 +1143,9 @@ static void decode_long_vertical_delta(uint8_t *dst,
x = bytestream2_get_be32(&dgb); x = bytestream2_get_be32(&dgb);
} }
if (ofsdst + (opcode - 1LL) * dstpitch > bytestream2_size_p(&pb))
return;
while (opcode) { while (opcode) {
bytestream2_seek_p(&pb, ofsdst, SEEK_SET); bytestream2_seek_p(&pb, ofsdst, SEEK_SET);
if (h && (j == (ncolumns - 1))) { if (h && (j == (ncolumns - 1))) {
@ -1283,6 +1286,9 @@ static void decode_long_vertical_delta2(uint8_t *dst,
x = bytestream2_get_be32(&gb); x = bytestream2_get_be32(&gb);
} }
if (ofsdst + (opcode - 1LL) * dstpitch > bytestream2_size_p(&pb))
return;
while (opcode && bytestream2_get_bytes_left_p(&pb) > 1) { while (opcode && bytestream2_get_bytes_left_p(&pb) > 1) {
bytestream2_seek_p(&pb, ofsdst, SEEK_SET); bytestream2_seek_p(&pb, ofsdst, SEEK_SET);
if (h && (j == ncolumns - 1)) if (h && (j == ncolumns - 1))