virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/vmnc: Check available space against chunks before reget_buffer()

Browse Source 
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 279d9a84af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-05-17 23:28:49 +02:00
parent 5fbc6dcdcc
commit eed8561f7c
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/vmnc.c
View File

@ -333,11 +333,15 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
uint8_t *outptr;
int dx, dy, w, h, depth, enc, chunks, res, size_left, ret;
bytestream2_init(gb, buf, buf_size);
bytestream2_skip(gb, 2);
chunks = bytestream2_get_be16(gb);
if (12LL * chunks > bytestream2_get_bytes_left(gb))
return AVERROR_INVALIDDATA;
if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
return ret;
bytestream2_init(gb, buf, buf_size);
c->pic->key_frame = 0;
c->pic->pict_type = AV_PICTURE_TYPE_P;
@ -369,8 +373,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
}
}
}
bytestream2_skip(gb, 2);
chunks = bytestream2_get_be16(gb);
while (chunks--) {
if (bytestream2_get_bytes_left(gb) < 12) {
av_log(avctx, AV_LOG_ERROR, "Premature end of data!\n");