RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-27 18:02:11 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/indeo4: Check dimensions in decode_pic_hdr()

Browse Source 
Fixes: Timeout
Fixes: 9654/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-6289863463665664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-08-26 01:58:32 +02:00
parent 64425e005e
commit 7592e88bfe
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/indeo4.c
View File

@ -30,6 +30,7 @@
#define BITSTREAM_READER_LE #define BITSTREAM_READER_LE
#include "avcodec.h" #include "avcodec.h"
#include "get_bits.h" #include "get_bits.h"
#include "libavutil/imgutils.h"
#include "indeo4data.h" #include "indeo4data.h"
#include "internal.h" #include "internal.h"
#include "ivi.h" #include "ivi.h"
@ -178,6 +179,13 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
pic_conf.chroma_bands = 0; pic_conf.chroma_bands = 0;
if (pic_conf.luma_bands) if (pic_conf.luma_bands)
pic_conf.chroma_bands = decode_plane_subdivision(&ctx->gb); pic_conf.chroma_bands = decode_plane_subdivision(&ctx->gb);
if (av_image_check_size2(pic_conf.pic_width, pic_conf.pic_height, avctx->max_pixels, AV_PIX_FMT_YUV410P, 0, avctx) < 0) {
av_log(avctx, AV_LOG_ERROR, "picture dimensions %d %d cannot be decoded\n",
pic_conf.pic_width, pic_conf.pic_height);
return AVERROR_INVALIDDATA;
}
ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1; ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) { if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n", av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n",