RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-04-11 03:32:39 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/targa: Check input size for uncompressed TGA before allocation

Browse Source 
Fixes: Timeout
Fixes: 42667/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5619236075077632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-12-23 20:17:14 +01:00
parent afdbc940c6
commit 68f8292aa9
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/targa.c
View File

@ -117,6 +117,7 @@ static int decode_frame(AVCodecContext *avctx,
int idlen, pal, compr, y, w, h, bpp, flags, ret; int idlen, pal, compr, y, w, h, bpp, flags, ret;
int first_clr, colors, csize; int first_clr, colors, csize;
int interleave; int interleave;
size_t img_size;
bytestream2_init(&s->gb, avpkt->data, avpkt->size); bytestream2_init(&s->gb, avpkt->data, avpkt->size);
@ -180,6 +181,15 @@ static int decode_frame(AVCodecContext *avctx,
return avpkt->size; return avpkt->size;
} }
if (!(compr & TGA_RLE)) {
img_size = w * ((bpp + 1) >> 3);
if (bytestream2_get_bytes_left(&s->gb) < img_size * h) {
av_log(avctx, AV_LOG_ERROR,
"Not enough data available for image\n");
return AVERROR_INVALIDDATA;
}
}
if ((ret = ff_get_buffer(avctx, p, 0)) < 0) if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
return ret; return ret;
p->pict_type = AV_PICTURE_TYPE_I; p->pict_type = AV_PICTURE_TYPE_I;
@ -251,7 +261,6 @@ static int decode_frame(AVCodecContext *avctx,
if (res < 0) if (res < 0)
return res; return res;
} else { } else {
size_t img_size = w * ((bpp + 1) >> 3);
uint8_t *line; uint8_t *line;
if (bytestream2_get_bytes_left(&s->gb) < img_size * h) { if (bytestream2_get_bytes_left(&s->gb) < img_size * h) {
av_log(avctx, AV_LOG_ERROR, av_log(avctx, AV_LOG_ERROR,