[FFmpeg-devel] [PATCH] avcodec/cfhd: Don't decode coefficients if no end of header tag found. Fixes fuzzed files

[Michael Niedermayer]

On Sun, Apr 10, 2016 at 04:22:26PM +0100, Kieran Kunhya wrote:
> ---
>  libavcodec/cfhd.c | 20 +++++++++++++++++++-
>  1 file changed, 19 insertions(+), 1 deletion(-)
> 
> diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c
> index d369568..d82eab8 100644
> --- a/libavcodec/cfhd.c
> +++ b/libavcodec/cfhd.c
> @@ -137,11 +137,17 @@ static void vert_filter(int16_t *output, int out_stride, int16_t *low, int low_s
>  static void free_buffers(AVCodecContext *avctx)
>  {
>      CFHDContext *s = avctx->priv_data;
> -    int i;
> +    int i, j;
>  
>      for (i = 0; i < 4; i++) {
>          av_freep(&s->plane[i].idwt_buf);
>          av_freep(&s->plane[i].idwt_tmp);

> +
> +        for (j = 0; j < 9; j++)
> +            s->plane[i].subband[j] = NULL;
> +
> +        for (j = 0; j < 8; j++)
> +            s->plane[i].l_h[j] = NULL;

memset() or 8/9 could be replaced by FF_ARRAY_ELEMS to avoid litteraly
duplicating the array size


>      }
>      s->a_height = 0;
>      s->a_width  = 0;
> @@ -450,6 +456,12 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
>              int lowpass_a_height = s->plane[s->channel_num].band[0][0].a_height;
>              int lowpass_a_width  = s->plane[s->channel_num].band[0][0].a_width;
>  
> +            if (!got_buffer) {
> +                av_log(avctx, AV_LOG_ERROR, "No end of header tag found\n");
> +                ret = AVERROR(EINVAL);
> +                goto end;
> +            }

AVERROR_INVALIDDATA

patch should be ok otherwise

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

There will always be a question for which you do not know the correct answer.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20160411/5e47a461/attachment.sig>