[FFmpeg-devel] [PATCH 4/4] avcodec/hqx: Check the input data against the image size

[Paul B Mahol]

On 7/21/19, Michael Niedermayer <michael at niedermayer.cc> wrote:
> On Sun, Jul 21, 2019 at 10:48:26AM +0200, Paul B Mahol wrote:
>> On 7/21/19, Michael Niedermayer <michael at niedermayer.cc> wrote:
>> > Fixes: Timeout (22 -> 7 sec)
>> > Fixes:
>> > 15173/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQX_fuzzer-5662556846292992
>> >
>> > Found-by: continuous fuzzing process
>> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>> > ---
>> >  libavcodec/hqx.c | 4 ++++
>> >  1 file changed, 4 insertions(+)
>> >
>> > diff --git a/libavcodec/hqx.c b/libavcodec/hqx.c
>> > index bc24ba91d1..8639d77a41 100644
>> > --- a/libavcodec/hqx.c
>> > +++ b/libavcodec/hqx.c
>> > @@ -471,6 +471,10 @@ static int hqx_decode_frame(AVCodecContext *avctx,
>> > void
>> > *data,
>> >      avctx->height              = ctx->height;
>> >      avctx->bits_per_raw_sample = 10;
>> >
>> > +    if (avctx->coded_width / 16 * (avctx->coded_height / 16) *
>> > +        (100 - avctx->discard_damaged_percentage) / 100 > 8LL *
>> > avpkt->size)
>> > +        return AVERROR_INVALIDDATA;
>>
>> Why just this change and not something better?
>
> What would you prefer exactly ?

Something that works with pure black video.

>
> Thanks
>
> [...]
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> Modern terrorism, a quick summary: Need oil, start war with country that
> has oil, kill hundread thousand in war. Let country fall into chaos,
> be surprised about raise of fundamantalists. Drop more bombs, kill more
> people, be surprised about them taking revenge and drop even more bombs
> and strip your own citizens of their rights and freedoms. to be continued
>