virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avcodec/rv10: Execute whole size check earlier for rv20

Browse Source 
Fixes: Timeout
Fixes: 31380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5230899257016320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2021-04-10 18:43:50 +02:00
parent 641c1db22b
commit f8556b632f
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/rv10.c
View File

@@ -154,7 +154,7 @@ static int rv10_decode_picture_header(MpegEncContext *s)
return mb_count; return mb_count;
} }
static int rv20_decode_picture_header(RVDecContext *rv) static int rv20_decode_picture_header(RVDecContext *rv, int whole_size)
{ {
MpegEncContext *s = &rv->m; MpegEncContext *s = &rv->m;
int seq, mb_pos, i, ret; int seq, mb_pos, i, ret;
@@ -232,6 +232,10 @@ static int rv20_decode_picture_header(RVDecContext *rv)
"attempting to change resolution to %dx%d\n", new_w, new_h); "attempting to change resolution to %dx%d\n", new_w, new_h);
if (av_image_check_size(new_w, new_h, 0, s->avctx) < 0) if (av_image_check_size(new_w, new_h, 0, s->avctx) < 0)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (whole_size < (new_w + 15)/16 * ((new_h + 15)/16) / 8)
return AVERROR_INVALIDDATA;
ff_mpv_common_end(s); ff_mpv_common_end(s);
// attempt to keep aspect during typical resolution switches // attempt to keep aspect during typical resolution switches
@@ -447,7 +451,7 @@ static int rv10_decode_packet(AVCodecContext *avctx, const uint8_t *buf,
if (s->codec_id == AV_CODEC_ID_RV10) if (s->codec_id == AV_CODEC_ID_RV10)
mb_count = rv10_decode_picture_header(s); mb_count = rv10_decode_picture_header(s);
else else
mb_count = rv20_decode_picture_header(rv); mb_count = rv20_decode_picture_header(rv, whole_size);
if (mb_count < 0) { if (mb_count < 0) {
if (mb_count != ERROR_SKIP_FRAME) if (mb_count != ERROR_SKIP_FRAME)
av_log(s->avctx, AV_LOG_ERROR, "HEADER ERROR\n"); av_log(s->avctx, AV_LOG_ERROR, "HEADER ERROR\n");