diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-08-26 01:58:32 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-09-03 00:01:32 +0200 |
| commit | 7592e88bfe3d5bf9109a55acd025af9110618405 (patch) | |
| tree | 51589b6ddee0fb1941d3a3a5aed8222c0b7f1855 | |
| parent | 64425e005edf3bdd77c34c078c3e74ab5ecef557 (diff) | |
| download | ffmpeg-7592e88bfe3d5bf9109a55acd025af9110618405.tar.gz | |
avcodec/indeo4: Check dimensions in decode_pic_hdr()
Fixes: Timeout
Fixes: 9654/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-6289863463665664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/indeo4.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c index 15ad6f8afc..4bfc6cdd74 100644 --- a/libavcodec/indeo4.c +++ b/libavcodec/indeo4.c @@ -30,6 +30,7 @@ #define BITSTREAM_READER_LE #include "avcodec.h" #include "get_bits.h" +#include "libavutil/imgutils.h" #include "indeo4data.h" #include "internal.h" #include "ivi.h" @@ -178,6 +179,13 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx) pic_conf.chroma_bands = 0; if (pic_conf.luma_bands) pic_conf.chroma_bands = decode_plane_subdivision(&ctx->gb); + + if (av_image_check_size2(pic_conf.pic_width, pic_conf.pic_height, avctx->max_pixels, AV_PIX_FMT_YUV410P, 0, avctx) < 0) { + av_log(avctx, AV_LOG_ERROR, "picture dimensions %d %d cannot be decoded\n", + pic_conf.pic_width, pic_conf.pic_height); + return AVERROR_INVALIDDATA; + } + ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1; if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) { av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n", |