[FFmpeg-devel] [PATCH] avcodec/v210dec: move the stride read after its fully initialized

[Michael Niedermayer]

On Wed, Dec 11, 2019 at 11:09:12PM +0800, Limin Wang wrote:
> On Sun, Dec 01, 2019 at 11:26:47PM +0100, Michael Niedermayer wrote:
> > Fixes: out of array read
> > Fixes: 19129/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_V210_fuzzer-5068171023482880
> > Maybe fixes: 19130/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_V210_fuzzer-5637264407527424
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/v210dec.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/v210dec.c b/libavcodec/v210dec.c
> > index 8483023815..044d35338b 100644
> > --- a/libavcodec/v210dec.c
> > +++ b/libavcodec/v210dec.c
> > @@ -153,7 +153,6 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
> >          int aligned_width = ((avctx->width + 47) / 48) * 48;
> >          stride = aligned_width * 8 / 3;
> >      }
> > -    td.stride = stride;
> >  
> >      if (avpkt->size < stride * avctx->height) {
> >          if ((((avctx->width + 23) / 24) * 24 * 8) / 3 * avctx->height == avpkt->size) {
> > @@ -166,6 +165,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
> >              return AVERROR_INVALIDDATA;
> >          }
> >      }
> > +    td.stride = stride;
> 
> LGTM

will apply

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Complexity theory is the science of finding the exact solution to an
approximation. Benchmarking OTOH is finding an approximation of the exact
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20191212/ca0ccd7f/attachment.sig>