Commit 38b6c48c authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/brenderpix: Check input size before allocating image

An incomplete image is not supported prior to this and will
not produce any output. This commit moves the failure before
time consuming operations.

Fixes: Timeout (81sec -> 76ms)
Fixes: 15723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BRENDER_PIX_fuzzer-5147265653538816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: 's avatarPaul B Mahol <onemda@gmail.com>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 1b9064e3
...@@ -204,6 +204,10 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, ...@@ -204,6 +204,10 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
avpriv_request_sample(avctx, "Format %d", hdr.format); avpriv_request_sample(avctx, "Format %d", hdr.format);
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
bytes_per_scanline = bytes_pp * hdr.width;
if (bytestream2_get_bytes_left(&gb) < hdr.height * bytes_per_scanline)
return AVERROR_INVALIDDATA;
if ((ret = ff_set_dimensions(avctx, hdr.width, hdr.height)) < 0) if ((ret = ff_set_dimensions(avctx, hdr.width, hdr.height)) < 0)
return ret; return ret;
...@@ -261,7 +265,6 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, ...@@ -261,7 +265,6 @@ static int pix_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
bytestream2_skip(&gb, 8); bytestream2_skip(&gb, 8);
// read the image data to the buffer // read the image data to the buffer
bytes_per_scanline = bytes_pp * hdr.width;
bytes_left = bytestream2_get_bytes_left(&gb); bytes_left = bytestream2_get_bytes_left(&gb);
if (chunk_type != IMAGE_DATA_CHUNK || data_len != bytes_left || if (chunk_type != IMAGE_DATA_CHUNK || data_len != bytes_left ||
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment