aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2022-08-13 22:47:31 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2022-08-28 23:07:04 +0200
commit9eb36ab0a1135327982afb8fa6f23e60cf50906c (patch)
treec4c3f0ec33dc6345df8af18c72cfee64c807f2c5
parent5d6b733277c68ebe3eeb8bc96a14b59d7e585794 (diff)
downloadffmpeg-9eb36ab0a1135327982afb8fa6f23e60cf50906c.tar.gz
avcodec/mjpegdec: bayer and rct are incompatible
Fixes: out of array read Fixes: 49434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5208501080686592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a44f5a521227adc7be2f78b411f56da1a4d98704) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/mjpegdec.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 32874a5a19..869aee425e 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -1092,6 +1092,10 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
return AVERROR_INVALIDDATA;
if (s->v_max != 1 || s->h_max != 1 || !s->lossless)
return AVERROR_INVALIDDATA;
+ if (s->bayer) {
+ if (s->rct || s->pegasus_rct)
+ return AVERROR_INVALIDDATA;
+ }
s->restart_count = s->restart_interval;
@@ -1942,6 +1946,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
}
len -= 9;
+ if (s->bayer)
+ goto out;
if (s->got_picture)
if (rgb != s->rgb || pegasus_rct != s->pegasus_rct) {
av_log(s->avctx, AV_LOG_WARNING, "Mismatching LJIF tag\n");