diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-10-23 23:31:03 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-01 12:49:26 +0200 |
| commit | 577f91346f799040f149c103bb486ccb097171e0 (patch) | |
| tree | c1b72e0a0c9a3029fa19463a4e07366cac2d6171 | |
| parent | d549c5d81f126c4453f3c8e6a95c34c1178c10a0 (diff) | |
| download | ffmpeg-577f91346f799040f149c103bb486ccb097171e0.tar.gz | |
avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()
Fixes: Timeout (31sec -> 41ms)
Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 32b3c8ce7d050210d210511cdb8c6644664a70ab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/iff.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c index 8b056a04a2..6e94aca6d7 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -1073,6 +1073,9 @@ static void decode_long_vertical_delta(uint8_t *dst, x = bytestream2_get_be32(&dgb); } + if (ofsdst + (opcode - 1LL) * dstpitch > bytestream2_size_p(&pb)) + return; + while (opcode) { bytestream2_seek_p(&pb, ofsdst, SEEK_SET); if (h && (j == (ncolumns - 1))) { @@ -1213,6 +1216,9 @@ static void decode_long_vertical_delta2(uint8_t *dst, x = bytestream2_get_be32(&gb); } + if (ofsdst + (opcode - 1LL) * dstpitch > bytestream2_size_p(&pb)) + return; + while (opcode && bytestream2_get_bytes_left_p(&pb) > 1) { bytestream2_seek_p(&pb, ofsdst, SEEK_SET); if (h && (j == ncolumns - 1)) |