RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/ituh263dec: Check input for minimal frame size 

Fixes: Timeout (28sec -> 3sec)
Fixes: 17559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H263_fuzzer-5681050776240128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f0498ed46)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-09-24 00:42:04 +02:00
parent 7bd58702f9
commit ae1b3038d0
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/ituh263dec.c
View File

@ -1218,6 +1218,11 @@ int ff_h263_decode_picture_header(MpegEncContext *s)
if ((ret = av_image_check_size(s->width, s->height, 0, s)) < 0) if ((ret = av_image_check_size(s->width, s->height, 0, s)) < 0)
return ret; return ret;
if (!(s->avctx->flags2 & AV_CODEC_FLAG2_CHUNKS)) {
if ((s->width * s->height / 256 / 8) > get_bits_left(&s->gb))
return AVERROR_INVALIDDATA;
}
s->mb_width = (s->width + 15) / 16; s->mb_width = (s->width + 15) / 16;
s->mb_height = (s->height + 15) / 16; s->mb_height = (s->height + 15) / 16;
s->mb_num = s->mb_width * s->mb_height; s->mb_num = s->mb_width * s->mb_height;