RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/vp3: Check width to avoid assertion failure 

Fixes: Assertion failure on x86-32
       av_assert2(block_w * sizeof(pixel) <= FFABS(buf_linesize)); in ff_emulated_edge_mc()
Fixes: 39641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5925660741206016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dab1cd2dc0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-03-26 22:35:50 +02:00
parent ed83667058
commit d4d83b910a
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/vp3.c
View File

@ -2336,6 +2336,8 @@ static av_cold int vp3_decode_init(AVCodecContext *avctx)
s->avctx = avctx;
s->width = FFALIGN(avctx->coded_width, 16);
s->height = FFALIGN(avctx->coded_height, 16);
if (s->width < 18)
return AVERROR_PATCHWELCOME;
if (avctx->codec_id != AV_CODEC_ID_THEORA)
avctx->pix_fmt = AV_PIX_FMT_YUV420P;
avctx->chroma_sample_location = AVCHROMA_LOC_CENTER;
@ -3007,7 +3009,9 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
/* sanity check */
if (av_image_check_size(visible_width, visible_height, 0, avctx) < 0 ||
visible_width + offset_x > s->width ||
visible_height + offset_y > s->height) {
visible_height + offset_y > s->height ||
visible_width < 18
) {
av_log(avctx, AV_LOG_ERROR,
"Invalid frame dimensions - w:%d h:%d x:%d y:%d (%dx%d).\n",
visible_width, visible_height, offset_x, offset_y,
@ -3053,6 +3057,8 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
} else
avctx->pix_fmt = AV_PIX_FMT_YUV420P;
if (s->width < 18)
return AVERROR_PATCHWELCOME;
ret = ff_set_dimensions(avctx, s->width, s->height);
if (ret < 0)
return ret;