diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-21 18:14:03 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-01-06 11:30:43 +0100 |
| commit | 3a661be4c4e26e14e4a0bc8a0177e9ca795199a5 (patch) | |
| tree | 2967b470d16c628c86b093fe204d6a5822ffbb9e /libavcodec | |
| parent | b1ae124919b557e417d2e8306e12f7c245dc5370 (diff) | |
| download | ffmpeg-3a661be4c4e26e14e4a0bc8a0177e9ca795199a5.tar.gz | |
avcodec/sunrast: Check that the input is large enough for the maximally compressed image
Fixes: Timeout (17sec -> 15ms)
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5663218491457536
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5735590015795200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf0ba75c4a9231ed62afe60bed5bde2728971e30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/sunrast.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c index 98bc4ffa63..e1ec8a0832 100644 --- a/libavcodec/sunrast.c +++ b/libavcodec/sunrast.c @@ -100,7 +100,11 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data, if (ret < 0) return ret; - if (buf_end - buf < maplength) + /* scanlines are aligned on 16 bit boundaries */ + len = (depth * w + 7) >> 3; + alen = len + (len & 1); + + if (buf_end - buf < maplength + (len * h) * 3 / 256) return AVERROR_INVALIDDATA; if ((ret = ff_get_buffer(avctx, p, 0)) < 0) @@ -136,10 +140,6 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data, stride = p->linesize[0]; } - /* scanlines are aligned on 16 bit boundaries */ - len = (depth * w + 7) >> 3; - alen = len + (len & 1); - if (type == RT_BYTE_ENCODED) { int value, run; uint8_t *end = ptr + h * stride; |