[FFmpeg-devel] [PATCH 2/2] avcodec/rasc: Check that the number of moves is less than or equal the number of pixels

Michael Niedermayer michael at niedermayer.cc
Sun Dec 16 11:15:31 EET 2018


On Sat, Dec 15, 2018 at 09:31:21AM +0100, Paul B Mahol wrote:
> On 12/15/18, Michael Niedermayer <michael at niedermayer.cc> wrote:
> > Fixes: OOM
> > Fixes:
> > 10307/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RASC_fuzzer-5393974559244288
> >
> > Found-by: continuous fuzzing process
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/rasc.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/libavcodec/rasc.c b/libavcodec/rasc.c
> > index 67351dfd19..1b607ac31e 100644
> > --- a/libavcodec/rasc.c
> > +++ b/libavcodec/rasc.c
> > @@ -215,7 +215,7 @@ static int decode_move(AVCodecContext *avctx,
> >      bytestream2_skip(gb, 8);
> >      compression = bytestream2_get_le32(gb);
> >
> > -    if (nb_moves > INT32_MAX / 16)
> > +    if (nb_moves > INT32_MAX / 16 || nb_moves > avctx->width *
> > avctx->height)
> >          return AVERROR_INVALIDDATA;
> >
> >      uncompressed_size = 16 * nb_moves;
> > --
> > 2.19.2
> >
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel at ffmpeg.org
> > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> >
> 
> OK

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you drop bombs on a foreign country and kill a hundred thousand
innocent people, expect your government to call the consequence
"unprovoked inhuman terrorist attacks" and use it to justify dropping
more bombs and killing more people. The technology changed, the idea is old.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20181216/e0153248/attachment.sig>


More information about the ffmpeg-devel mailing list