Michael Niedermayer: > The snow encoder uses block based motion estimation which can read out of > array if > insufficient alignment is used > > Fixes: out of array access > Fixes: > 68963/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4979988435632128 > Fixes: > 68969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6239933667803136.fuzz > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > --- > libavcodec/utils.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/utils.c b/libavcodec/utils.c > index 337c00e789a..7914f799041 100644 > --- a/libavcodec/utils.c > +++ b/libavcodec/utils.c > @@ -259,6 +259,9 @@ void avcodec_align_dimensions2(AVCodecContext *s, int > *width, int *height, > if (s->codec_id == AV_CODEC_ID_SVQ1) { > w_align = 64; > h_align = 64; > + } else if (s->codec_id == AV_CODEC_ID_SNOW) { > + w_align = 16; > + h_align = 16; > } > break; > case AV_PIX_FMT_RGB555:
avcodec_align_dimensions2() is for decoders and happens to be used by ff_encode_alloc_frame(), too. But decoders should not be required to add more padding because the decoder needs more. Instead the encoder should add more padding itself (by using more than 2 * EDGE_WIDTH). - Andreas _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
