Commit f6df99db authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/dstdec: Check for input exhaustion

Fixes: Timeout (239sec -> 16sec)
Fixes: 17811/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5715508149616640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: 's avatarPaul B Mahol <onemda@gmail.com>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent a5d29812
...@@ -56,6 +56,7 @@ static const int8_t probs_code_pred_coeff[3][3] = { ...@@ -56,6 +56,7 @@ static const int8_t probs_code_pred_coeff[3][3] = {
typedef struct ArithCoder { typedef struct ArithCoder {
unsigned int a; unsigned int a;
unsigned int c; unsigned int c;
int overread;
} ArithCoder; } ArithCoder;
typedef struct Table { typedef struct Table {
...@@ -172,6 +173,7 @@ static void ac_init(ArithCoder *ac, GetBitContext *gb) ...@@ -172,6 +173,7 @@ static void ac_init(ArithCoder *ac, GetBitContext *gb)
{ {
ac->a = 4095; ac->a = 4095;
ac->c = get_bits(gb, 12); ac->c = get_bits(gb, 12);
ac->overread = 0;
} }
static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, int *e) static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, int *e)
...@@ -191,6 +193,8 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in ...@@ -191,6 +193,8 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in
if (ac->a < 2048) { if (ac->a < 2048) {
int n = 11 - av_log2(ac->a); int n = 11 - av_log2(ac->a);
ac->a <<= n; ac->a <<= n;
if (get_bits_left(gb) < n)
ac->overread ++;
ac->c = (ac->c << n) | get_bits(gb, n); ac->c = (ac->c << n) | get_bits(gb, n);
} }
} }
...@@ -339,6 +343,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, ...@@ -339,6 +343,9 @@ static int decode_frame(AVCodecContext *avctx, void *data,
prob = 128; prob = 128;
} }
if (ac->overread > 16)
return AVERROR_INVALIDDATA;
ac_get(ac, gb, prob, &residual); ac_get(ac, gb, prob, &residual);
v = ((predict >> 15) ^ residual) & 1; v = ((predict >> 15) ^ residual) & 1;
dsd[((i >> 3) * channels + ch) << 2] |= v << (7 - (i & 0x7 )); dsd[((i >> 3) * channels + ch) << 2] |= v << (7 - (i & 0x7 ));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment