[FFmpeg-cvslog] avcodec/g2meet: Check if adjusted pixel was on the stack

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon Sep  9 20:05:09 2019 +0200| [9c84c162e9f9f000ef47d4fcd07354805f38d455] | committer: Michael Niedermayer

avcodec/g2meet: Check if adjusted pixel was on the stack

This basically checks if a pixel that was coded with prediction
and residual could have been stored using a previous case.
This avoids basically a string of 0 symbols stored in less than
50 bytes to hit a O(n²) codepath.

Fixes: Timeout (too slow to wait -> immediately)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-4895946310680576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9c84c162e9f9f000ef47d4fcd07354805f38d455
---

 libavcodec/g2meet.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index a1dec8d823..19e1c130ce 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -854,6 +854,9 @@ static int epic_decode_tile(ePICContext *dc, uint8_t *out, int tile_height,
                     uint32_t ref_pix = curr_row[x - 1];
                     if (!x || !epic_decode_from_cache(dc, ref_pix, &pix)) {
                         pix = epic_decode_pixel_pred(dc, x, y, curr_row, above_row);
+                        if (is_pixel_on_stack(dc, pix))
+                            return AVERROR_INVALIDDATA;
+
                         if (x) {
                             int ret = epic_add_pixel_to_cache(&dc->hash,
                                                               ref_pix,