Fixes: Timeout (Infinite -> 26ms) Fixes: 15706/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5114674904825856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/tiff.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index c520d7df83..e3bdd8612e 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -37,6 +37,7 @@ #include "libavutil/avstring.h" #include "libavutil/intreadwrite.h" #include "libavutil/imgutils.h" +#include "libavutil/loop_detector.h" #include "libavutil/opt.h" #include "avcodec.h" #include "bytestream.h" @@ -1407,6 +1408,7 @@ static int decode_frame(AVCodecContext *avctx, GetByteContext stripsizes; GetByteContext stripdata; int retry_for_subifd, retry_for_page; + AVSimpleLoopDetector loop_detector = {0}; bytestream2_init(&s->gb, avpkt->data, avpkt->size); @@ -1467,6 +1469,10 @@ again: av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n"); return AVERROR_INVALIDDATA; } + if (av_is_loop(&loop_detector, off, INT64_MAX)) { + av_log(avctx, AV_LOG_ERROR, "too many retries\n"); + return AVERROR_INVALIDDATA; + } s->sub_ifd = 0; goto again; } -- 2.22.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
