[FFmpeg-cvslog] avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so

Michael Niedermayer git at videolan.org
Fri May 5 14:39:38 EEST 2017


ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Fri May  5 12:48:12 2017 +0200| [ce551a3925a1cf9c7824e26a246b99b6773bda4b] | committer: Michael Niedermayer

avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so

Fixes: out of array access
Fixes: 1348/clusterfuzz-testcase-minimized-6195673642827776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ce551a3925a1cf9c7824e26a246b99b6773bda4b
---

 libavcodec/tiertexseqv.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/tiertexseqv.c b/libavcodec/tiertexseqv.c
index 06c5fd6b09..af39f74d7d 100644
--- a/libavcodec/tiertexseqv.c
+++ b/libavcodec/tiertexseqv.c
@@ -213,10 +213,15 @@ static int seqvideo_decode(SeqVideoContext *seq, const unsigned char *data, int
 static av_cold int seqvideo_decode_init(AVCodecContext *avctx)
 {
     SeqVideoContext *seq = avctx->priv_data;
+    int ret;
 
     seq->avctx = avctx;
     avctx->pix_fmt = AV_PIX_FMT_PAL8;
 
+    ret = ff_set_dimensions(avctx, 256, 128);
+    if (ret < 0)
+        return ret;
+
     seq->frame = av_frame_alloc();
     if (!seq->frame)
         return AVERROR(ENOMEM);



More information about the ffmpeg-cvslog mailing list