har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()

Browse Source 
Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit faa5a2181df53b5226f998a20b735798addcd365)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-06-04 13:38:02 +02:00
parent 7edf958740
commit 90c38d6ab8
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/pafvideo.c
View File

@ -267,12 +267,20 @@ static int paf_video_decode(AVCodecContext *avctx, void *data,
uint8_t code, *dst, *end; uint8_t code, *dst, *end;
int i, frame, ret; int i, frame, ret;
if ((ret = ff_reget_buffer(avctx, c->pic)) < 0) if (pkt->size < 2)
return ret; return AVERROR_INVALIDDATA;
bytestream2_init(&c->gb, pkt->data, pkt->size); bytestream2_init(&c->gb, pkt->data, pkt->size);
code = bytestream2_get_byte(&c->gb); code = bytestream2_get_byte(&c->gb);
if ((code & 0xF) > 4) {
avpriv_request_sample(avctx, "unknown/invalid code");
return AVERROR_INVALIDDATA;
}
if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
return ret;
if (code & 0x20) { // frame is keyframe if (code & 0x20) { // frame is keyframe
for (i = 0; i < 4; i++) for (i = 0; i < 4; i++)
memset(c->frame[i], 0, c->frame_size); memset(c->frame[i], 0, c->frame_size);
@ -367,8 +375,7 @@ static int paf_video_decode(AVCodecContext *avctx, void *data,
} }
break; break;
default: default:
avpriv_request_sample(avctx, "unknown/invalid code"); av_assert0(0);
return AVERROR_INVALIDDATA;
} }
av_image_copy_plane(c->pic->data[0], c->pic->linesize[0], av_image_copy_plane(c->pic->data[0], c->pic->linesize[0],