virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-10-30 23:18:11 +02:00
Code Issues Releases Activity

avcodec/vp6: clear dimensions on failed resolution change in vp6_parse_header()

Browse Source 
Fixes: 807/clusterfuzz-testcase-6470061042696192
Fixes null pointer dereference

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2017-03-12 03:04:06 +01:00
parent a66c6e28b5
commit 967feea5eb
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/vp6.c
View File

@@ -108,7 +108,7 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
ret = ff_vp56_init_range_decoder(c, buf+6, buf_size-6); ret = ff_vp56_init_range_decoder(c, buf+6, buf_size-6);
if (ret < 0) if (ret < 0)
return ret; goto fail;
vp56_rac_gets(c, 2); vp56_rac_gets(c, 2);
parse_filter_info = s->filter_header; parse_filter_info = s->filter_header;
@@ -162,9 +162,8 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
buf += coeff_offset; buf += coeff_offset;
buf_size -= coeff_offset; buf_size -= coeff_offset;
if (buf_size < 0) { if (buf_size < 0) {
if (s->frames[VP56_FRAME_CURRENT]->key_frame) ret = AVERROR_INVALIDDATA;
ff_set_dimensions(s->avctx, 0, 0); goto fail;
return AVERROR_INVALIDDATA;
} }
if (s->use_huffman) { if (s->use_huffman) {
s->parse_coeff = vp6_parse_coeff_huffman; s->parse_coeff = vp6_parse_coeff_huffman;
@@ -172,7 +171,7 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
} else { } else {
ret = ff_vp56_init_range_decoder(&s->cc, buf, buf_size); ret = ff_vp56_init_range_decoder(&s->cc, buf, buf_size);
if (ret < 0) if (ret < 0)
return ret; goto fail;
s->ccp = &s->cc; s->ccp = &s->cc;
} }
} else { } else {
@@ -180,6 +179,10 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
} }
return res; return res;
fail:
if (res == VP56_SIZE_CHANGE)
ff_set_dimensions(s->avctx, 0, 0);
return ret;
} }
static void vp6_coeff_order_table_init(VP56Context *s) static void vp6_coeff_order_table_init(VP56Context *s)