virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-21 10:55:51 +02:00
Code Issues Releases Activity

avcodec/mpeg12dec: Limit maximum A53 CC size

Browse Source 
This is more than 10 times the size of the largest i found. And also alot more
than our encoder could handle (our encoder is limited to max 31)
Without any limit megabyte+ sized blocks can be reallocated millions of times.
Sadly the SCTE-20 spec does not seem to contain any hard limit directly, so this limit here
is arbitrary

Fixes: Timeout (25sec -> 152ms)
Fixes: 25714/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5713633336885248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-09-21 22:40:48 +02:00
parent 34df97b088
commit ee33fecb62
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/mpeg12dec.c
View File

@ -50,6 +50,8 @@
#include "version.h"
#include "xvmc_internal.h"
#define A53_MAX_CC_COUNT 2000
typedef struct Mpeg1Context {
MpegEncContext mpeg_enc_ctx;
int mpeg_enc_ctx_allocated; /* true if decoding context allocated */
@ -2240,7 +2242,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
* UINT64_C(3));
int ret;
if (new_size > INT_MAX)
if (new_size > 3*A53_MAX_CC_COUNT)
return AVERROR(EINVAL);
ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
@ -2263,7 +2265,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
int old_size = s1->a53_buf_ref ? s1->a53_buf_ref->size : 0;
const uint64_t new_size = (old_size + cc_count
* UINT64_C(3));
if (new_size > INT_MAX)
if (new_size > 3*A53_MAX_CC_COUNT)
return AVERROR(EINVAL);
ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
@ -2333,7 +2335,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
int old_size = s1->a53_buf_ref ? s1->a53_buf_ref->size : 0;
const uint64_t new_size = (old_size + cc_count
* UINT64_C(6));
if (new_size > INT_MAX)
if (new_size > 3*A53_MAX_CC_COUNT)
return AVERROR(EINVAL);
ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);