[FFmpeg-devel] [PATCH 1/2] avcodec/hapdec: Check tex_size more strictly and before using it
Michael Niedermayer
michael at niedermayer.cc
Sat Mar 28 23:12:45 EET 2020
Fixes: OOM
Fixes: 20774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5678608951803904
Fixes: 20956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5713643025203200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
libavcodec/hapdec.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/libavcodec/hapdec.c b/libavcodec/hapdec.c
index d23ceb5cef..e4abd739c5 100644
--- a/libavcodec/hapdec.c
+++ b/libavcodec/hapdec.c
@@ -342,6 +342,13 @@ static int hap_decode(AVCodecContext *avctx, void *data,
if (ret < 0)
return ret;
+ if (ctx->tex_size != (avctx->coded_width / TEXTURE_BLOCK_W)
+ *(avctx->coded_height / TEXTURE_BLOCK_H)
+ *tex_rat[t]) {
+ av_log(avctx, AV_LOG_ERROR, "uncompressed size mismatches\n");
+ return AVERROR_INVALIDDATA;
+ }
+
start_texture_section += ctx->texture_section_size + 4;
if (avctx->codec->update_thread_context)
@@ -370,13 +377,6 @@ static int hap_decode(AVCodecContext *avctx, void *data,
tex_size = ctx->tex_size;
}
- if (tex_size < (avctx->coded_width / TEXTURE_BLOCK_W)
- *(avctx->coded_height / TEXTURE_BLOCK_H)
- *tex_rat[t]) {
- av_log(avctx, AV_LOG_ERROR, "Insufficient data\n");
- return AVERROR_INVALIDDATA;
- }
-
/* Use the decompress function on the texture, one block per thread */
if (t == 0){
avctx->execute2(avctx, decompress_texture_thread, tframe.f, NULL, ctx->slice_count);
--
2.17.1
More information about the ffmpeg-devel
mailing list