diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-10-23 20:57:12 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-12-06 20:30:57 +0100 |
| commit | f1a20096f76a4d7a17f79eef81f3d106d05aa042 (patch) | |
| tree | 613e52f444d6ef95ad63bcd895e655992a76ab7d | |
| parent | 08a0c3cd179a9da59577846d388ac4f5b64a5ce4 (diff) | |
| download | ffmpeg-f1a20096f76a4d7a17f79eef81f3d106d05aa042.tar.gz | |
avcodec/vp5: Check render_x/y
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 698e042c77ecb5b0d616de254adc783e8b61b9c4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/vp5.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c index d18fd5b289..c57c4a2987 100644 --- a/libavcodec/vp5.c +++ b/libavcodec/vp5.c @@ -49,6 +49,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size) ff_vp56_init_dequant(s, vp56_rac_gets(c, 6)); if (s->frames[VP56_FRAME_CURRENT]->key_frame) { + int render_x, render_y; + vp56_rac_gets(c, 8); if(vp56_rac_gets(c, 5) > 5) return AVERROR_INVALIDDATA; @@ -64,8 +66,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size) cols << 4, rows << 4); return AVERROR_INVALIDDATA; } - vp56_rac_gets(c, 8); /* number of displayed macroblock rows */ - vp56_rac_gets(c, 8); /* number of displayed macroblock cols */ + render_y = vp56_rac_gets(c, 8); /* number of displayed macroblock rows */ + render_x = vp56_rac_gets(c, 8); /* number of displayed macroblock cols */ + if (render_x == 0 || render_x > cols || + render_y == 0 || render_y > rows) + return AVERROR_INVALIDDATA; vp56_rac_gets(c, 2); if (!s->macroblocks || /* first frame */ 16*cols != s->avctx->coded_width || |