mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-03-17 20:17:55 +02:00
avcodec/nuv: Check for minimum input size for uncomprssed and rtjpeg
Fixes: Timeout Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 8ee3265dbe2e85537affe3b3055b00ba8646aa70) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
8ba8e0a1c7
commit
0312060329
@ -161,6 +161,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
|
||||
int orig_size = buf_size;
|
||||
int keyframe, ret;
|
||||
int size_change = 0;
|
||||
int minsize = 0;
|
||||
int result, init_frame = !avctx->frame_number;
|
||||
enum {
|
||||
NUV_UNCOMPRESSED = '0',
|
||||
@ -206,6 +207,16 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
|
||||
keyframe = 1;
|
||||
break;
|
||||
}
|
||||
switch (comptype) {
|
||||
case NUV_UNCOMPRESSED:
|
||||
minsize = c->width * c->height * 3 / 2;
|
||||
break;
|
||||
case NUV_RTJPEG:
|
||||
minsize = c->width/16 * (c->height/16) * 6;
|
||||
break;
|
||||
}
|
||||
if (buf_size < minsize / 4)
|
||||
return AVERROR_INVALIDDATA;
|
||||
retry:
|
||||
// Skip the rest of the frame header.
|
||||
buf = &buf[12];
|
||||
|
Loading…
x
Reference in New Issue
Block a user