RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-05 06:40:03 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/gemdec: Check tag & planes before image allocation

Browse Source 
Fixes: Timeout
Fixes: 41083/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GEM_fuzzer-5843826518917120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-11-27 21:00:07 +01:00
parent 024e934480
commit 6e34d94797
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/gemdec.c
View File

@ -157,6 +157,14 @@ static int gem_decode_frame(AVCodecContext *avctx,
if (header_size >= 11) if (header_size >= 11)
tag = bytestream2_peek_be32(&gb); tag = bytestream2_peek_be32(&gb);
if (tag == AV_RB32("STTT") || tag == AV_RB32("TIMG") || tag == AV_RB32("XIMG") ||
planes == 1 || planes == 2 || planes == 3 || planes == 4 ||
planes == 8 || planes == 16 || planes == 24) {
} else {
avpriv_request_sample(avctx, "planes=%d", planes);
return AVERROR_PATCHWELCOME;
}
if ((ret = ff_get_buffer(avctx, p, 0)) < 0) if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
return ret; return ret;
@ -236,9 +244,6 @@ static int gem_decode_frame(AVCodecContext *avctx,
planes = 1; planes = 1;
row_width = avctx->width * pixel_size; row_width = avctx->width * pixel_size;
put_lines = put_lines_bytes; put_lines = put_lines_bytes;
} else {
avpriv_request_sample(avctx, "planes=%d", planes);
return AVERROR_PATCHWELCOME;
} }
ret = av_reallocp_array(&avctx->priv_data, planes, row_width); ret = av_reallocp_array(&avctx->priv_data, planes, row_width);