Fixes: OOM Fixes: 42263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5653333619113984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/tiff.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 9af602eef70..60773d59ed0 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -724,13 +724,14 @@ static int dng_decode_jpeg(AVCodecContext *avctx, AVFrame *frame, static int dng_decode_strip(AVCodecContext *avctx, AVFrame *frame) { TiffContext *s = avctx->priv_data; + int ret = ff_set_dimensions(s->avctx_mjpeg, s->width, s->height); + + if (ret < 0) + return ret; s->jpgframe->width = s->width; s->jpgframe->height = s->height; - s->avctx_mjpeg->width = s->width; - s->avctx_mjpeg->height = s->height; - return dng_decode_jpeg(avctx, frame, s->stripsize, 0, 0, s->width, s->height); } @@ -971,14 +972,14 @@ static int dng_decode_tiles(AVCodecContext *avctx, AVFrame *frame, int has_width_leftover, has_height_leftover; int tile_x = 0, tile_y = 0; int pos_x = 0, pos_y = 0; - int ret; + int ret = ff_set_dimensions(s->avctx_mjpeg, s->tile_width, s->tile_length); + + if (ret < 0) + return ret; s->jpgframe->width = s->tile_width; s->jpgframe->height = s->tile_length; - s->avctx_mjpeg->width = s->tile_width; - s->avctx_mjpeg->height = s->tile_length; - has_width_leftover = (s->width % s->tile_width != 0); has_height_leftover = (s->height % s->tile_length != 0); -- 2.17.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
