mån 2019-08-12 klockan 21:17 +0200 skrev Michael Niedermayer:
> Fixes: Timeout (12sec -> 32ms)
> Fixes: 16078/clusterfuzz-testcase-minimized-
> ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5695832885559296
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
> ---
> libavcodec/cinepak.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/libavcodec/cinepak.c b/libavcodec/cinepak.c
> index aeb15de0ed..62eb794332 100644
> --- a/libavcodec/cinepak.c
> +++ b/libavcodec/cinepak.c
> @@ -356,6 +356,9 @@ static int cinepak_predecode_check
> (CinepakContext *s)
> if (s->size < 10 + s->sega_film_skip_bytes + num_strips * 12)
> return AVERROR_INVALIDDATA;
>
> + if (s->size < (s->avctx->width * s->avctx->height) / (4*4*8))
> + return AVERROR_INVALIDDATA;
This is wrong if num_strips == 0, and if the MB area is != 0 mod 8. You
could merge it with the check above into something like:
if (s->size < 10 + s->sega_film_skip_bytes + num_strips * 12 +
(num_strips ? ((s->avctx->width * s->avctx->height) / 16 + 7)/8 :
0)) {
return AVERROR_INVALIDDATA;
}
The check further down could also check each strip's size, not just the
first one.
Finally, I don't think we should accept files with num_strips >
MAX_STRIPS in cinepak_decode(). We should ask for samples of them
instead.
/Tomas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
