RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-27 09:52:17 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/vp5: Check render_x/y

Browse Source 
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-10-23 20:57:12 +02:00
parent 66589d9bd9
commit 698e042c77
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/vp5.c
View File

@ -48,6 +48,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
ff_vp56_init_dequant(s, vp56_rac_gets(c, 6));
if (s->frames[VP56_FRAME_CURRENT]->key_frame)
{
int render_x, render_y;
vp56_rac_gets(c, 8);
if(vp56_rac_gets(c, 5) > 5)
return AVERROR_INVALIDDATA;
@ -63,8 +65,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
cols << 4, rows << 4);
return AVERROR_INVALIDDATA;
}
vp56_rac_gets(c, 8); /* number of displayed macroblock rows */
vp56_rac_gets(c, 8); /* number of displayed macroblock cols */
render_y = vp56_rac_gets(c, 8); /* number of displayed macroblock rows */
render_x = vp56_rac_gets(c, 8); /* number of displayed macroblock cols */
if (render_x == 0 || render_x > cols ||
render_y == 0 || render_y > rows)
return AVERROR_INVALIDDATA;
vp56_rac_gets(c, 2);
if (!s->macroblocks || /* first frame */
16*cols != s->avctx->coded_width ||