[FFmpeg-cvslog] avcodec/qtrle: Check how much of the chunk is available before decoding

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Tue Apr  2 02:18:34 2019 +0200| [af77adc02e4a814007c50d7fde6ef5e9837ca5a5] | committer: Michael Niedermayer

avcodec/qtrle: Check how much of the chunk is available before decoding

Fixes: Timeout (10sec -> 2sec)
Fixes: 13979/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QTRLE_fuzzer-5635157718990848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=af77adc02e4a814007c50d7fde6ef5e9837ca5a5
---

 libavcodec/qtrle.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavcodec/qtrle.c b/libavcodec/qtrle.c
index 1613530e02..2c29547e5a 100644
--- a/libavcodec/qtrle.c
+++ b/libavcodec/qtrle.c
@@ -452,7 +452,7 @@ static int qtrle_decode_frame(AVCodecContext *avctx,
     int header, start_line;
     int height, row_ptr;
     int has_palette = 0;
-    int ret;
+    int ret, size;
 
     bytestream2_init(&s->g, avpkt->data, avpkt->size);
 
@@ -461,7 +461,10 @@ static int qtrle_decode_frame(AVCodecContext *avctx,
         return avpkt->size;
 
     /* start after the chunk size */
-    bytestream2_seek(&s->g, 4, SEEK_SET);
+    size = bytestream2_get_be32(&s->g) & 0x3FFFFFFF;
+    if (size - avpkt->size >  size * (int64_t)avctx->discard_damaged_percentage / 100)
+        return AVERROR_INVALIDDATA;
+
 
     /* fetch the header */
     header = bytestream2_get_be16(&s->g);