virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-29 22:00:58 +02:00
Code Issues Releases Activity

avcodec/fitsdec: Prevent division by 0 with huge data_max

Browse Source 
Fixes: division by 0
Fixes: 15657/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5738154838982656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cfa193779103c97bbfc28273a0ab12c114b6786d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-07-15 23:42:42 +02:00
parent 3ba1413f04
commit ae4bfed934
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/fitsdec.c
View File

@ -195,6 +195,7 @@ static int fits_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
uint8_t *dst8; uint8_t *dst8;
uint16_t *dst16; uint16_t *dst16;
uint64_t t; uint64_t t;
double scale;
FITSHeader header; FITSHeader header;
FITSContext * fitsctx = avctx->priv_data; FITSContext * fitsctx = avctx->priv_data;
@ -204,6 +205,12 @@ static int fits_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
if (ret < 0) if (ret < 0)
return ret; return ret;
scale = header.data_max - header.data_min;
if (scale <= 0 || !isfinite(scale)) {
scale = 1;
}
scale = 1/scale;
if (header.rgb) { if (header.rgb) {
if (header.bitpix == 8) { if (header.bitpix == 8) {
if (header.naxisn[2] == 3) { if (header.naxisn[2] == 3) {
@ -272,7 +279,7 @@ static int fits_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
for (j = 0; j < avctx->width; j++) { \ for (j = 0; j < avctx->width; j++) { \
t = rd; \ t = rd; \
if (!header.blank_found || t != header.blank) { \ if (!header.blank_found || t != header.blank) { \
*dst++ = ((t - header.data_min) * ((1 << (sizeof(type) * 8)) - 1)) / (header.data_max - header.data_min); \ *dst++ = ((t - header.data_min) * ((1 << (sizeof(type) * 8)) - 1)) * scale; \
} else { \ } else { \
*dst++ = fitsctx->blank_val; \ *dst++ = fitsctx->blank_val; \
} \ } \