RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/qtrle: Check how much of the chunk is available before decoding 

Fixes: Timeout (10sec -> 2sec)
Fixes: 13979/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QTRLE_fuzzer-5635157718990848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-04-02 02:18:34 +02:00
parent 8ea211ab79
commit af77adc02e
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/qtrle.c
View File

@ -452,7 +452,7 @@ static int qtrle_decode_frame(AVCodecContext *avctx,
int header, start_line; int header, start_line;
int height, row_ptr; int height, row_ptr;
int has_palette = 0; int has_palette = 0;
int ret; int ret, size;
bytestream2_init(&s->g, avpkt->data, avpkt->size); bytestream2_init(&s->g, avpkt->data, avpkt->size);
@ -461,7 +461,10 @@ static int qtrle_decode_frame(AVCodecContext *avctx,
return avpkt->size; return avpkt->size;
/* start after the chunk size */ /* start after the chunk size */
bytestream2_seek(&s->g, 4, SEEK_SET); size = bytestream2_get_be32(&s->g) & 0x3FFFFFFF;
if (size - avpkt->size > size * (int64_t)avctx->discard_damaged_percentage / 100)
return AVERROR_INVALIDDATA;
/* fetch the header */ /* fetch the header */
header = bytestream2_get_be16(&s->g); header = bytestream2_get_be16(&s->g);