virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-21 10:55:51 +02:00
Code Issues Releases Activity

avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int'

Browse Source 
Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-06-10 19:43:25 +02:00
parent 54aaadf648
commit 90e8317b3b
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/flicvideo.c
View File

@ -272,10 +272,14 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
while (compressed_lines > 0) { while (compressed_lines > 0) {
if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk) if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
break; break;
if (y_ptr > pixel_limit)
return AVERROR_INVALIDDATA;
line_packets = bytestream2_get_le16(&g2); line_packets = bytestream2_get_le16(&g2);
if ((line_packets & 0xC000) == 0xC000) { if ((line_packets & 0xC000) == 0xC000) {
// line skip opcode // line skip opcode
line_packets = -line_packets; line_packets = -line_packets;
if (line_packets > s->avctx->height)
return AVERROR_INVALIDDATA;
y_ptr += line_packets * s->frame->linesize[0]; y_ptr += line_packets * s->frame->linesize[0];
} else if ((line_packets & 0xC000) == 0x4000) { } else if ((line_packets & 0xC000) == 0x4000) {
av_log(avctx, AV_LOG_ERROR, "Undefined opcode (%x) in DELTA_FLI\n", line_packets); av_log(avctx, AV_LOG_ERROR, "Undefined opcode (%x) in DELTA_FLI\n", line_packets);
@ -324,6 +328,8 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
case FLI_LC: case FLI_LC:
/* line compressed */ /* line compressed */
starting_line = bytestream2_get_le16(&g2); starting_line = bytestream2_get_le16(&g2);
if (starting_line >= s->avctx->height)
return AVERROR_INVALIDDATA;
y_ptr = 0; y_ptr = 0;
y_ptr += starting_line * s->frame->linesize[0]; y_ptr += starting_line * s->frame->linesize[0];
@ -564,9 +570,13 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
while (compressed_lines > 0) { while (compressed_lines > 0) {
if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk) if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
break; break;
if (y_ptr > pixel_limit)
return AVERROR_INVALIDDATA;
line_packets = bytestream2_get_le16(&g2); line_packets = bytestream2_get_le16(&g2);
if (line_packets < 0) { if (line_packets < 0) {
line_packets = -line_packets; line_packets = -line_packets;
if (line_packets > s->avctx->height)
return AVERROR_INVALIDDATA;
y_ptr += line_packets * s->frame->linesize[0]; y_ptr += line_packets * s->frame->linesize[0];
} else { } else {
compressed_lines--; compressed_lines--;
@ -858,9 +868,13 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
while (compressed_lines > 0) { while (compressed_lines > 0) {
if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk) if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
break; break;
if (y_ptr > pixel_limit)
return AVERROR_INVALIDDATA;
line_packets = bytestream2_get_le16(&g2); line_packets = bytestream2_get_le16(&g2);
if (line_packets < 0) { if (line_packets < 0) {
line_packets = -line_packets; line_packets = -line_packets;
if (line_packets > s->avctx->height)
return AVERROR_INVALIDDATA;
y_ptr += line_packets * s->frame->linesize[0]; y_ptr += line_packets * s->frame->linesize[0];
} else { } else {
compressed_lines--; compressed_lines--;