diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2025-05-11 19:41:18 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2025-05-15 03:03:57 +0200 |
| commit | 4a9d907b5eb93c0efe09ddd947ae5f462689f6f2 (patch) | |
| tree | 43f8846bbaced1d15419ffc4362013ee685f58bb | |
| parent | 8168ebdcc5550ea671fe3cbfff00df259ff82ca2 (diff) | |
| download | ffmpeg-4a9d907b5eb93c0efe09ddd947ae5f462689f6f2.tar.gz | |
avcodec/4xm: Check frame_4cc before allocation
Fixes: Timeout
Fixes: 403402798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5012819292782592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/4xm.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index fd3a45f093..94f4268127 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -927,8 +927,11 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture, frame_size = buf_size - 12; } - if ((ret = ff_get_buffer(avctx, picture, 0)) < 0) - return ret; + if ( frame_4cc == AV_RL32("ifr2") || frame_4cc == AV_RL32("ifrm") + || frame_4cc == AV_RL32("pfrm") || frame_4cc == AV_RL32("pfr2")) { + if ((ret = ff_get_buffer(avctx, picture, 0)) < 0) + return ret; + } if (frame_4cc == AV_RL32("ifr2")) { picture->pict_type = AV_PICTURE_TYPE_I; |