[FFmpeg-cvslog] avcodec/vmnc: Check available space against chunks before reget_buffer()
Michael Niedermayer
git at videolan.org
Tue Jun 4 14:20:30 EEST 2019
ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Fri May 17 23:28:49 2019 +0200| [279d9a84af37cc1a7cf79c1cd667105eeb948611] | committer: Michael Niedermayer
avcodec/vmnc: Check available space against chunks before reget_buffer()
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=279d9a84af37cc1a7cf79c1cd667105eeb948611
---
libavcodec/vmnc.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/libavcodec/vmnc.c b/libavcodec/vmnc.c
index 30b1414e49..e273043311 100644
--- a/libavcodec/vmnc.c
+++ b/libavcodec/vmnc.c
@@ -333,11 +333,15 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
uint8_t *outptr;
int dx, dy, w, h, depth, enc, chunks, res, size_left, ret;
+ bytestream2_init(gb, buf, buf_size);
+ bytestream2_skip(gb, 2);
+ chunks = bytestream2_get_be16(gb);
+ if (12LL * chunks > bytestream2_get_bytes_left(gb))
+ return AVERROR_INVALIDDATA;
+
if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
return ret;
- bytestream2_init(gb, buf, buf_size);
-
c->pic->key_frame = 0;
c->pic->pict_type = AV_PICTURE_TYPE_P;
@@ -369,8 +373,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
}
}
}
- bytestream2_skip(gb, 2);
- chunks = bytestream2_get_be16(gb);
+
while (chunks--) {
if (bytestream2_get_bytes_left(gb) < 12) {
av_log(avctx, AV_LOG_ERROR, "Premature end of data!\n");
More information about the ffmpeg-cvslog
mailing list