diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-04-10 18:43:50 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-04-20 16:58:20 +0200 |
| commit | f8556b632f4b29e54067ecba6f71ceb8af3806e4 (patch) | |
| tree | 80c994654a337a930b26857ac8a89cf6709c7f15 /libavcodec/rv10.c | |
| parent | 641c1db22bb27752b925293ad93f68843baa43bf (diff) | |
| download | ffmpeg-f8556b632f4b29e54067ecba6f71ceb8af3806e4.tar.gz | |
avcodec/rv10: Execute whole size check earlier for rv20
Fixes: Timeout
Fixes: 31380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5230899257016320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/rv10.c')
| -rw-r--r-- | libavcodec/rv10.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c index bd70689cab..9c3a48c251 100644 --- a/libavcodec/rv10.c +++ b/libavcodec/rv10.c @@ -154,7 +154,7 @@ static int rv10_decode_picture_header(MpegEncContext *s) return mb_count; } -static int rv20_decode_picture_header(RVDecContext *rv) +static int rv20_decode_picture_header(RVDecContext *rv, int whole_size) { MpegEncContext *s = &rv->m; int seq, mb_pos, i, ret; @@ -232,6 +232,10 @@ static int rv20_decode_picture_header(RVDecContext *rv) "attempting to change resolution to %dx%d\n", new_w, new_h); if (av_image_check_size(new_w, new_h, 0, s->avctx) < 0) return AVERROR_INVALIDDATA; + + if (whole_size < (new_w + 15)/16 * ((new_h + 15)/16) / 8) + return AVERROR_INVALIDDATA; + ff_mpv_common_end(s); // attempt to keep aspect during typical resolution switches @@ -447,7 +451,7 @@ static int rv10_decode_packet(AVCodecContext *avctx, const uint8_t *buf, if (s->codec_id == AV_CODEC_ID_RV10) mb_count = rv10_decode_picture_header(s); else - mb_count = rv20_decode_picture_header(rv); + mb_count = rv20_decode_picture_header(rv, whole_size); if (mb_count < 0) { if (mb_count != ERROR_SKIP_FRAME) av_log(s->avctx, AV_LOG_ERROR, "HEADER ERROR\n"); |