diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-09 20:05:09 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-01 12:49:26 +0200 |
| commit | 4dda4cd7751e2b1b73ea805d8b4ee313134e1535 (patch) | |
| tree | c9df165f2438d8f695113ecd087cf9ff4973761e | |
| parent | 2f10c7553eaa5c8722939ea99d88b2159b987f97 (diff) | |
| download | ffmpeg-4dda4cd7751e2b1b73ea805d8b4ee313134e1535.tar.gz | |
avcodec/g2meet: Check if adjusted pixel was on the stack
This basically checks if a pixel that was coded with prediction
and residual could have been stored using a previous case.
This avoids basically a string of 0 symbols stored in less than
50 bytes to hit a O(n²) codepath.
Fixes: Timeout (too slow to wait -> immediately)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-4895946310680576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c84c162e9f9f000ef47d4fcd07354805f38d455)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/g2meet.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c index d6adb441c4..d94b2f7001 100644 --- a/libavcodec/g2meet.c +++ b/libavcodec/g2meet.c @@ -853,6 +853,9 @@ static int epic_decode_tile(ePICContext *dc, uint8_t *out, int tile_height, uint32_t ref_pix = curr_row[x - 1]; if (!x || !epic_decode_from_cache(dc, ref_pix, &pix)) { pix = epic_decode_pixel_pred(dc, x, y, curr_row, above_row); + if (is_pixel_on_stack(dc, pix)) + return AVERROR_INVALIDDATA; + if (x) { int ret = epic_add_pixel_to_cache(&dc->hash, ref_pix, |