RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/targaenc: Allocate space for the palette 

Fixes: out of array access
Fixes: 68927/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5105665067515904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a7220bd5c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-06-16 19:33:02 +02:00
parent 0258d8302d
commit dfb6bd6b08
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/targaenc.c
View File

@ -21,6 +21,7 @@
#include <string.h>
#include "libavutil/avassert.h"
#include "libavutil/imgutils.h"
#include "libavutil/internal.h"
#include "libavutil/intreadwrite.h"
@ -88,10 +89,11 @@ static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
TargaContext *s = avctx->priv_data;
int bpp, picsize, datasize = -1, ret, i;
uint8_t *out;
int maxpal = 32*32;
picsize = av_image_get_buffer_size(avctx->pix_fmt,
avctx->width, avctx->height, 1);
if ((ret = ff_alloc_packet2(avctx, pkt, picsize + 45, 0)) < 0)
if ((ret = ff_alloc_packet2(avctx, pkt, picsize + 45 + maxpal, 0)) < 0)
return ret;
/* zero out the header and only set applicable fields */
@ -124,6 +126,7 @@ static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
AV_WL24(pkt->data + 18 + 3 * i, *(uint32_t *)(p->data[1] + i * 4));
}
out += 32 * pal_bpp; /* skip past the palette we just output */
av_assert0(32 * pal_bpp <= maxpal);
break;
}
case AV_PIX_FMT_GRAY8: