RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/dxtory: Check slice_size against minimum in dxtory_decode_v2() 

Fixes: Timeout (33sec -> 16 milli sec)
Fixes: 14181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-5681840708386816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-04-14 20:23:24 +02:00
parent fee6661045
commit 9570322a2d
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/dxtory.c
View File

@ -286,8 +286,14 @@ static int dxtory_decode_v2(AVCodecContext *avctx, AVFrame *pic,
off_check = off;
gb_check = gb;
for (slice = 0; slice < nslices; slice++)
off_check += bytestream2_get_le32(&gb_check);
for (slice = 0; slice < nslices; slice++) {
slice_size = bytestream2_get_le32(&gb_check);
if (slice_size <= 16 + (avctx->height * avctx->width / (8 * nslices)))
return AVERROR_INVALIDDATA;
off_check += slice_size;
}
if (off_check - avctx->discard_damaged_percentage*off_check/100 > src_size)
return AVERROR_INVALIDDATA;