virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avcodec/sanm: Checks related to negative left/top

Browse Source 
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248
Fixes: out of array access

Reviewed-by: Manuel Lauss <manuel.lauss@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-06-19 03:35:45 +02:00
parent b849ac006b
commit ab73bd94a3
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/sanm.c
View File

@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
bytestream2_skip(gb, 2);
parm2 = bytestream2_get_le16u(gb);
if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) {
if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) {
av_log(ctx->avctx, AV_LOG_WARNING,
"ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
codec, w, h, left, top);
@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
}
}
} else {
if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) {
if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) {
/* correct unexpected overly large frames: this happens
* for instance with The Dig's sq1.san video: it has a few
* (all black) 640x480 frames halfway in, while the rest is
@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb)
if ((w == ctx->width) && (h == ctx->height)) {
memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size);
} else {
uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
const uint8_t *src = (uint8_t *)ctx->frm0;
const int cw = FFMIN(w, ctx->width - left);
const int ch = FFMIN(h, ctx->height - top);
if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) {
uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
for (int i = 0; i < ch; i++) {
memcpy(dst, src, cw);
dst += ctx->pitch;