diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-12-23 20:17:14 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-12-30 22:20:14 +0100 |
| commit | 68f8292aa96d99b733ca7d2e56b584b00263db84 (patch) | |
| tree | 8066f99476672ad040e4eb11d13f3d0d143da1be /libavcodec | |
| parent | afdbc940c6011b64c1856f88d2b0609369f87406 (diff) | |
| download | ffmpeg-68f8292aa96d99b733ca7d2e56b584b00263db84.tar.gz | |
avcodec/targa: Check input size for uncompressed TGA before allocation
Fixes: Timeout
Fixes: 42667/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5619236075077632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/targa.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/libavcodec/targa.c b/libavcodec/targa.c index 221fcc956d..b0048621d3 100644 --- a/libavcodec/targa.c +++ b/libavcodec/targa.c @@ -117,6 +117,7 @@ static int decode_frame(AVCodecContext *avctx, int idlen, pal, compr, y, w, h, bpp, flags, ret; int first_clr, colors, csize; int interleave; + size_t img_size; bytestream2_init(&s->gb, avpkt->data, avpkt->size); @@ -180,6 +181,15 @@ static int decode_frame(AVCodecContext *avctx, return avpkt->size; } + if (!(compr & TGA_RLE)) { + img_size = w * ((bpp + 1) >> 3); + if (bytestream2_get_bytes_left(&s->gb) < img_size * h) { + av_log(avctx, AV_LOG_ERROR, + "Not enough data available for image\n"); + return AVERROR_INVALIDDATA; + } + } + if ((ret = ff_get_buffer(avctx, p, 0)) < 0) return ret; p->pict_type = AV_PICTURE_TYPE_I; @@ -251,7 +261,6 @@ static int decode_frame(AVCodecContext *avctx, if (res < 0) return res; } else { - size_t img_size = w * ((bpp + 1) >> 3); uint8_t *line; if (bytestream2_get_bytes_left(&s->gb) < img_size * h) { av_log(avctx, AV_LOG_ERROR, |