[FFmpeg-cvslog] avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Wed Oct 23 23:31:03 2019 +0200| [32b3c8ce7d050210d210511cdb8c6644664a70ab] | committer: Michael Niedermayer

avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()

Fixes: Timeout (31sec -> 41ms)
Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=32b3c8ce7d050210d210511cdb8c6644664a70ab
---

 libavcodec/iff.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index c18bac1ea1..500f9bf367 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -1143,6 +1143,9 @@ static void decode_long_vertical_delta(uint8_t *dst,
                         x = bytestream2_get_be32(&dgb);
                     }
 
+                    if (ofsdst + (opcode - 1LL) * dstpitch > bytestream2_size_p(&pb))
+                        return;
+
                     while (opcode) {
                         bytestream2_seek_p(&pb, ofsdst, SEEK_SET);
                         if (h && (j == (ncolumns - 1))) {
@@ -1283,6 +1286,9 @@ static void decode_long_vertical_delta2(uint8_t *dst,
                         x = bytestream2_get_be32(&gb);
                     }
 
+                    if (ofsdst + (opcode - 1LL) * dstpitch > bytestream2_size_p(&pb))
+                        return;
+
                     while (opcode && bytestream2_get_bytes_left_p(&pb) > 1) {
                         bytestream2_seek_p(&pb, ofsdst, SEEK_SET);
                         if (h && (j == ncolumns - 1))