Commit 7592e88b authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/indeo4: Check dimensions in decode_pic_hdr()

Fixes: Timeout
Fixes: 9654/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-6289863463665664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 64425e00
......@@ -30,6 +30,7 @@
#define BITSTREAM_READER_LE
#include "avcodec.h"
#include "get_bits.h"
#include "libavutil/imgutils.h"
#include "indeo4data.h"
#include "internal.h"
#include "ivi.h"
......@@ -178,6 +179,13 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
pic_conf.chroma_bands = 0;
if (pic_conf.luma_bands)
pic_conf.chroma_bands = decode_plane_subdivision(&ctx->gb);
if (av_image_check_size2(pic_conf.pic_width, pic_conf.pic_height, avctx->max_pixels, AV_PIX_FMT_YUV410P, 0, avctx) < 0) {
av_log(avctx, AV_LOG_ERROR, "picture dimensions %d %d cannot be decoded\n",
pic_conf.pic_width, pic_conf.pic_height);
return AVERROR_INVALIDDATA;
}
ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment