diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-05-17 23:28:49 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-01 12:11:55 +0200 |
| commit | 71d929366344fe5fb926ca45e5cc354dea67081e (patch) | |
| tree | b5a48861e0741744c5907f7b11366e58e0f679d4 | |
| parent | 806d1e3253e19379afd2dacff80df1fd1b52b726 (diff) | |
| download | ffmpeg-71d929366344fe5fb926ca45e5cc354dea67081e.tar.gz | |
avcodec/vmnc: Check available space against chunks before reget_buffer()
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 279d9a84af37cc1a7cf79c1cd667105eeb948611)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/vmnc.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/libavcodec/vmnc.c b/libavcodec/vmnc.c index dfabfd394a..ccbc7632c7 100644 --- a/libavcodec/vmnc.c +++ b/libavcodec/vmnc.c @@ -326,11 +326,15 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, uint8_t *outptr; int dx, dy, w, h, depth, enc, chunks, res, size_left, ret; + bytestream2_init(gb, buf, buf_size); + bytestream2_skip(gb, 2); + chunks = bytestream2_get_be16(gb); + if (12LL * chunks > bytestream2_get_bytes_left(gb)) + return AVERROR_INVALIDDATA; + if ((ret = ff_reget_buffer(avctx, c->pic)) < 0) return ret; - bytestream2_init(gb, buf, buf_size); - c->pic->key_frame = 0; c->pic->pict_type = AV_PICTURE_TYPE_P; @@ -362,8 +366,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, } } } - bytestream2_skip(gb, 2); - chunks = bytestream2_get_be16(gb); + while (chunks--) { if (bytestream2_get_bytes_left(gb) < 12) { av_log(avctx, AV_LOG_ERROR, "Premature end of data!\n"); |