[FFmpeg-cvslog] avcodec/dxtory: Check slice_size against minimum in dxtory_decode_v2()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun Apr 14 20:23:24 2019 +0200| [9570322a2d8c122de3f1fa8079641950e01c5712] | committer: Michael Niedermayer

avcodec/dxtory: Check slice_size against minimum in dxtory_decode_v2()

Fixes: Timeout (33sec -> 16 milli sec)
Fixes: 14181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-5681840708386816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9570322a2d8c122de3f1fa8079641950e01c5712
---

 libavcodec/dxtory.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavcodec/dxtory.c b/libavcodec/dxtory.c
index 7024b315d1..4dd675316b 100644
--- a/libavcodec/dxtory.c
+++ b/libavcodec/dxtory.c
@@ -286,8 +286,14 @@ static int dxtory_decode_v2(AVCodecContext *avctx, AVFrame *pic,
 
     off_check = off;
     gb_check = gb;
-    for (slice = 0; slice < nslices; slice++)
-        off_check += bytestream2_get_le32(&gb_check);
+    for (slice = 0; slice < nslices; slice++) {
+        slice_size = bytestream2_get_le32(&gb_check);
+
+        if (slice_size <= 16 + (avctx->height * avctx->width / (8 * nslices)))
+            return AVERROR_INVALIDDATA;
+        off_check += slice_size;
+    }
+
     if (off_check - avctx->discard_damaged_percentage*off_check/100 > src_size)
         return AVERROR_INVALIDDATA;