[FFmpeg-devel] [PATCH 2/2] avcodec/huffyuvdec: Test vertical coordinate more often

[Paul B Mahol]

probably ok

On 6/5/20, Michael Niedermayer <michael at niedermayer.cc> wrote:
> Fixes: out of array access
> Fixes:
> 22892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5135996772679680.fuzz
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/huffyuvdec.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/libavcodec/huffyuvdec.c b/libavcodec/huffyuvdec.c
> index 0ee7ec3917..e713b91e4d 100644
> --- a/libavcodec/huffyuvdec.c
> +++ b/libavcodec/huffyuvdec.c
> @@ -928,12 +928,16 @@ static int decode_slice(AVCodecContext *avctx, AVFrame
> *p, int height,
>                  left= left_prediction(s, p->data[plane], s->temp[0], w, 0);
>
>                  y = 1;
> +                if (y >= h)
> +                    break;
>
>                  /* second line is left predicted for interlaced case */
>                  if (s->interlaced) {
>                      decode_plane_bitstream(s, w, plane);
>                      left = left_prediction(s, p->data[plane] +
> p->linesize[plane], s->temp[0], w, left);
>                      y++;
> +                    if (y >= h)
> +                        break;
>                  }
>
>                  lefttop = p->data[plane][0];
> @@ -1045,6 +1049,8 @@ static int decode_slice(AVCodecContext *avctx, AVFrame
> *p, int height,
>                  }
>
>                  cy = y = 1;
> +                if (y >= height)
> +                    break;
>
>                  /* second line is left predicted for interlaced case */
>                  if (s->interlaced) {
> @@ -1057,6 +1063,8 @@ static int decode_slice(AVCodecContext *avctx, AVFrame
> *p, int height,
>                      }
>                      y++;
>                      cy++;
> +                    if (y >= height)
> +                        break;
>                  }
>
>                  /* next 4 pixels are left predicted too */
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".