aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2023-03-26 22:35:50 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2023-04-15 22:38:11 +0200
commitabddc911ffc3086093a24f3188d044aa5b9b1766 (patch)
tree8ab11dae066673876c590d5251bed9c15628582a
parent8ee94724dfac311229879620e5e8c87e0d0d9e45 (diff)
downloadffmpeg-abddc911ffc3086093a24f3188d044aa5b9b1766.tar.gz
avcodec/vp3: Check width to avoid assertion failure
Fixes: Assertion failure on x86-32 av_assert2(block_w * sizeof(pixel) <= FFABS(buf_linesize)); in ff_emulated_edge_mc() Fixes: 39641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5925660741206016 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit dab1cd2dc0471d497f481736059b2023c5b7986a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/vp3.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 65907e8d04..3c1d7e7a17 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -2332,6 +2332,8 @@ static av_cold int vp3_decode_init(AVCodecContext *avctx)
s->avctx = avctx;
s->width = FFALIGN(avctx->coded_width, 16);
s->height = FFALIGN(avctx->coded_height, 16);
+ if (s->width < 18)
+ return AVERROR_PATCHWELCOME;
if (avctx->codec_id != AV_CODEC_ID_THEORA)
avctx->pix_fmt = AV_PIX_FMT_YUV420P;
avctx->chroma_sample_location = AVCHROMA_LOC_CENTER;
@@ -2978,7 +2980,9 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
/* sanity check */
if (av_image_check_size(visible_width, visible_height, 0, avctx) < 0 ||
visible_width + offset_x > s->width ||
- visible_height + offset_y > s->height) {
+ visible_height + offset_y > s->height ||
+ visible_width < 18
+ ) {
av_log(avctx, AV_LOG_ERROR,
"Invalid frame dimensions - w:%d h:%d x:%d y:%d (%dx%d).\n",
visible_width, visible_height, offset_x, offset_y,
@@ -3024,6 +3028,8 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
} else
avctx->pix_fmt = AV_PIX_FMT_YUV420P;
+ if (s->width < 18)
+ return AVERROR_PATCHWELCOME;
ret = ff_set_dimensions(avctx, s->width, s->height);
if (ret < 0)
return ret;