RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/pnm: Use ff_set_dimensions() 

Fixes: OOM
Fixes: 1906/clusterfuzz-testcase-minimized-4599315114754048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-31 13:39:45 +02:00
parent 58f8cd4ac5
commit a1c0d1d906
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/pnm.c
View File

@ -24,6 +24,7 @@
#include "libavutil/imgutils.h" #include "libavutil/imgutils.h"
#include "avcodec.h" #include "avcodec.h"
#include "internal.h"
#include "pnm.h" #include "pnm.h"
static inline int pnm_space(int c) static inline int pnm_space(int c)
@ -61,6 +62,7 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)
{ {
char buf1[32], tuple_type[32]; char buf1[32], tuple_type[32];
int h, w, depth, maxval; int h, w, depth, maxval;
int ret;
pnm_get(s, buf1, sizeof(buf1)); pnm_get(s, buf1, sizeof(buf1));
if(buf1[0] != 'P') if(buf1[0] != 'P')
@ -111,8 +113,9 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)
av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end) av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
avctx->width = w; ret = ff_set_dimensions(avctx, w, h);
avctx->height = h; if (ret < 0)
return ret;
s->maxval = maxval; s->maxval = maxval;
if (depth == 1) { if (depth == 1) {
if (maxval == 1) { if (maxval == 1) {
@ -154,8 +157,9 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)
if(w <= 0 || h <= 0 || av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end) if(w <= 0 || h <= 0 || av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
avctx->width = w; ret = ff_set_dimensions(avctx, w, h);
avctx->height = h; if (ret < 0)
return ret;
if (avctx->pix_fmt != AV_PIX_FMT_MONOWHITE && avctx->pix_fmt != AV_PIX_FMT_MONOBLACK) { if (avctx->pix_fmt != AV_PIX_FMT_MONOWHITE && avctx->pix_fmt != AV_PIX_FMT_MONOBLACK) {
pnm_get(s, buf1, sizeof(buf1)); pnm_get(s, buf1, sizeof(buf1));