[FFmpeg-devel] [PATCH 1/2] avcodec/vp7: Check for end of input in vp78_decode_mv_mb_modes()

[Michael Niedermayer]

On Sat, Dec 15, 2018 at 01:21:52PM +1100, Peter Ross wrote:
> On Sat, Dec 15, 2018 at 02:44:43AM +0100, Michael Niedermayer wrote:
> > Fixes: Timeout
> > Fixes: 10313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP7_fuzzer-5637719389110272
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/vp8.c | 21 ++++++++++++++-------
> >  1 file changed, 14 insertions(+), 7 deletions(-)
> > 
> > diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c
> > index a06692c476..ba79e5fdab 100644
> > --- a/libavcodec/vp8.c
> > +++ b/libavcodec/vp8.c
> > @@ -2268,7 +2268,7 @@ void filter_mb_simple(VP8Context *s, uint8_t *dst, VP8FilterStrength *f,
> >  
> >  #define MARGIN (16 << 2)
> >  static av_always_inline
> > -void vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe,
> > +int vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe,
> >                                      VP8Frame *prev_frame, int is_vp7)
> >  {
> >      VP8Context *s = avctx->priv_data;
> > @@ -2285,6 +2285,10 @@ void vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe,
> >  
> >          s->mv_bounds.mv_min.x = -MARGIN;
> >          s->mv_bounds.mv_max.x = ((s->mb_width - 1) << 6) + MARGIN;
> > +
> > +        if (vpX_rac_is_end(&s->c)) {
> > +            return AVERROR_INVALIDDATA;
> > +        }
> >          for (mb_x = 0; mb_x < s->mb_width; mb_x++, mb_xy++, mb++) {
> 
> ok.

will apply

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Good people do not need laws to tell them to act responsibly, while bad
people will find a way around the laws. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20181216/e88f4e2d/attachment.sig>