diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-01-03 23:24:15 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-03 12:10:23 +0200 |
| commit | 57278dac15cba65b34717ff3e2c97c4303bb6581 (patch) | |
| tree | eaef57167b6d2fba5ef4a6b4c03f83bfde59fb49 /libavcodec | |
| parent | e1bea6d4121801f5b42112246754d7d2efd97cb4 (diff) | |
| download | ffmpeg-57278dac15cba65b34717ff3e2c97c4303bb6581.tar.gz | |
avcodec/iff: Over-allocate ham_palbuf for HAM6 IFF-PBM
IFF-PBM-HAM6 can read out of array without this overallocation
Fixes: Out of array read
Fixes: 19752/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5675331403120640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8652f4e7a15e56fadf9697188c1ed42c9981db82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/iff.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c index a03f80ce53..72e3ae73b2 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -332,13 +332,17 @@ static int extract_header(AVCodecContext *const avctx, int i, count = FFMIN(palette_size / 3, 1 << s->ham); int ham_count; const uint8_t *const palette = avctx->extradata + AV_RB16(avctx->extradata); + int extra_space = 1; + + if (avctx->codec_tag == MKTAG('P', 'B', 'M', ' ') && s->ham == 4) + extra_space = 4; s->ham_buf = av_malloc((s->planesize * 8) + AV_INPUT_BUFFER_PADDING_SIZE); if (!s->ham_buf) return AVERROR(ENOMEM); ham_count = 8 * (1 << s->ham); - s->ham_palbuf = av_malloc((ham_count << !!(s->masking == MASK_HAS_MASK)) * sizeof (uint32_t) + AV_INPUT_BUFFER_PADDING_SIZE); + s->ham_palbuf = av_malloc(extra_space * (ham_count << !!(s->masking == MASK_HAS_MASK)) * sizeof (uint32_t) + AV_INPUT_BUFFER_PADDING_SIZE); if (!s->ham_palbuf) { av_freep(&s->ham_buf); return AVERROR(ENOMEM); |