diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-14 00:15:55 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-18 11:33:16 +0200 |
| commit | b9f92093a10217b14d923220aaa186f41a0cf555 (patch) | |
| tree | 0c737f75aa690726d6c4343f0c0d0944b8e67753 /libavcodec/ffv1dec.c | |
| parent | c359c51947c9ac925cc4a5d1893ef20ea1d3b4c8 (diff) | |
| download | ffmpeg-b9f92093a10217b14d923220aaa186f41a0cf555.tar.gz | |
avcodec/ffv1dec: Check for bitstream end in decode_line()
Fixes: timeout
Fixes: 2971/clusterfuzz-testcase-6130678276030464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/ffv1dec.c')
| -rw-r--r-- | libavcodec/ffv1dec.c | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index 20921c6adf..b13ecd3eab 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -93,6 +93,19 @@ static inline int get_vlc_symbol(GetBitContext *gb, VlcState *const state, return ret; } +static int is_input_end(FFV1Context *s) +{ + if (s->ac != AC_GOLOMB_RICE) { + RangeCoder *const c = &s->c; + if (c->overread > MAX_OVERREAD) + return AVERROR_INVALIDDATA; + } else { + if (get_bits_left(&s->gb) < 1) + return AVERROR_INVALIDDATA; + } + return 0; +} + #define TYPE int16_t #define RENAME(name) name #include "ffv1dec_template.c" @@ -103,7 +116,7 @@ static inline int get_vlc_symbol(GetBitContext *gb, VlcState *const state, #define RENAME(name) name ## 32 #include "ffv1dec_template.c" -static void decode_plane(FFV1Context *s, uint8_t *src, +static int decode_plane(FFV1Context *s, uint8_t *src, int w, int h, int stride, int plane_index, int pixel_stride) { @@ -127,11 +140,15 @@ static void decode_plane(FFV1Context *s, uint8_t *src, // { START_TIMER if (s->avctx->bits_per_raw_sample <= 8) { - decode_line(s, w, sample, plane_index, 8); + int ret = decode_line(s, w, sample, plane_index, 8); + if (ret < 0) + return ret; for (x = 0; x < w; x++) src[x*pixel_stride + stride * y] = sample[1][x]; } else { - decode_line(s, w, sample, plane_index, s->avctx->bits_per_raw_sample); + int ret = decode_line(s, w, sample, plane_index, s->avctx->bits_per_raw_sample); + if (ret < 0) + return ret; if (s->packed_at_lsb) { for (x = 0; x < w; x++) { ((uint16_t*)(src + stride*y))[x*pixel_stride] = sample[1][x]; @@ -144,6 +161,7 @@ static void decode_plane(FFV1Context *s, uint8_t *src, } // STOP_TIMER("decode-line") } } + return 0; } static int decode_slice_header(FFV1Context *f, FFV1Context *fs) |