diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-22 19:21:50 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-12-02 19:41:48 +0100 |
| commit | a58dfb447eacf11b9773c9b2dbf1b489e05fc837 (patch) | |
| tree | ea4ae2002a6ca7f8f5405963e93ede332d5790ad | |
| parent | ace8a759e67ef7e620ce2c3b32cc413c2001e716 (diff) | |
| download | ffmpeg-a58dfb447eacf11b9773c9b2dbf1b489e05fc837.tar.gz | |
avcodec/iff: Check ham vs bpp
This checks the ham value much stricter and avoids hitting cases which cannot be reached
with data from the libavformat demuxer.
Fixes: out of array access
Fixes: 15320/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5080476840099840
Fixes: 15423/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5630765833912320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f76d7352e05526fde7c607b9a9db536a5760af29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/iff.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c index c26bb97ab4..42d29ffb53 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -235,6 +235,16 @@ static int extract_header(AVCodecContext *const avctx, for (i = 0; i < 16; i++) s->tvdc[i] = bytestream_get_be16(&buf); + if (s->ham) { + if (s->bpp > 8) { + av_log(avctx, AV_LOG_ERROR, "Invalid number of hold bits for HAM: %u\n", s->ham); + return AVERROR_INVALIDDATA; + } if (s->ham != (s->bpp > 6 ? 6 : 4)) { + av_log(avctx, AV_LOG_ERROR, "Invalid number of hold bits for HAM: %u, BPP: %u\n", s->ham, s->bpp); + return AVERROR_INVALIDDATA; + } + } + if (s->masking == MASK_HAS_MASK) { if (s->bpp >= 8 && !s->ham) { avctx->pix_fmt = AV_PIX_FMT_RGB32; @@ -262,9 +272,6 @@ static int extract_header(AVCodecContext *const avctx, if (!s->bpp || s->bpp > 32) { av_log(avctx, AV_LOG_ERROR, "Invalid number of bitplanes: %u\n", s->bpp); return AVERROR_INVALIDDATA; - } else if (s->ham >= 8) { - av_log(avctx, AV_LOG_ERROR, "Invalid number of hold bits for HAM: %u\n", s->ham); - return AVERROR_INVALIDDATA; } av_freep(&s->ham_buf); |