diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-24 00:42:04 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-01-06 11:30:43 +0100 |
| commit | 71e56b44ed558a7c7b46c2686c40d1ade2cfd95f (patch) | |
| tree | 6a3e94aaeaa97197db3f942ed0a0c71dcf075f88 /libavcodec/ituh263dec.c | |
| parent | cc2a9190861547b8a5a70505a5c51dcec58e2508 (diff) | |
| download | ffmpeg-71e56b44ed558a7c7b46c2686c40d1ade2cfd95f.tar.gz | |
avcodec/ituh263dec: Check input for minimal frame size
Fixes: Timeout (28sec -> 3sec)
Fixes: 17559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H263_fuzzer-5681050776240128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f0498ed461987b62bb97ff6463b4df108d60d78)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/ituh263dec.c')
| -rw-r--r-- | libavcodec/ituh263dec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/ituh263dec.c b/libavcodec/ituh263dec.c index 8bedaac536..6d1d771c16 100644 --- a/libavcodec/ituh263dec.c +++ b/libavcodec/ituh263dec.c @@ -1218,6 +1218,11 @@ int ff_h263_decode_picture_header(MpegEncContext *s) if ((ret = av_image_check_size(s->width, s->height, 0, s)) < 0) return ret; + if (!(s->avctx->flags2 & AV_CODEC_FLAG2_CHUNKS)) { + if ((s->width * s->height / 256 / 8) > get_bits_left(&s->gb)) + return AVERROR_INVALIDDATA; + } + s->mb_width = (s->width + 15) / 16; s->mb_height = (s->height + 15) / 16; s->mb_num = s->mb_width * s->mb_height; |