aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2018-09-12 02:48:04 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2018-11-04 12:53:16 +0100
commit470700bc96c3817667653d87e81b06a3d9b832eb (patch)
tree42ad518a0af1994cb9df4ff4a33469df8d807627
parentdf91af140c5543cfbbed187f696e79b554d2c135 (diff)
downloadffmpeg-470700bc96c3817667653d87e81b06a3d9b832eb.tar.gz
avcodec/pictordec: Error out if more than one plane is unused
Fixes: Timeout Fixes: 9797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PICTOR_fuzzer-5664441659031552 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/pictordec.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/pictordec.c b/libavcodec/pictordec.c
index b29a484534..65d2d49060 100644
--- a/libavcodec/pictordec.c
+++ b/libavcodec/pictordec.c
@@ -236,6 +236,9 @@ static int decode_frame(AVCodecContext *avctx,
}
}
+ if (s->nb_planes - plane > 1)
+ return AVERROR_INVALIDDATA;
+
if (plane < s->nb_planes && x < avctx->width) {
int run = (y + 1) * avctx->width - x;
if (bits_per_plane == 8)