[FFmpeg-devel] [PATCH 5/5] avcodec/sunrast: Check that the input is large enough for the maximally compressed image
Michael Niedermayer
michael at niedermayer.cc
Sat Sep 21 19:57:28 EEST 2019
Fixes: Timeout (17sec -> 15ms)
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5663218491457536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
libavcodec/sunrast.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c
index 98bc4ffa63..e1ec8a0832 100644
--- a/libavcodec/sunrast.c
+++ b/libavcodec/sunrast.c
@@ -100,7 +100,11 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
if (ret < 0)
return ret;
- if (buf_end - buf < maplength)
+ /* scanlines are aligned on 16 bit boundaries */
+ len = (depth * w + 7) >> 3;
+ alen = len + (len & 1);
+
+ if (buf_end - buf < maplength + (len * h) * 3 / 256)
return AVERROR_INVALIDDATA;
if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
@@ -136,10 +140,6 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
stride = p->linesize[0];
}
- /* scanlines are aligned on 16 bit boundaries */
- len = (depth * w + 7) >> 3;
- alen = len + (len & 1);
-
if (type == RT_BYTE_ENCODED) {
int value, run;
uint8_t *end = ptr + h * stride;
--
2.23.0
More information about the ffmpeg-devel
mailing list