mirrors/librempeg
1
0
Fork 0
mirror of https://github.com/librempeg/librempeg synced 2024-11-23 11:39:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/pngdec: consider chunk size in minimal size check

Browse Source 
assuming each block contains an empty chunk there has to be at least 8 bytes extra.

Fixes: 15327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LSCR_fuzzer-5676669303521280
Fixes: Timeout (11->5sec)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-07-22 00:03:15 +02:00
parent c9415e815a
commit 70432eac0b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/pngdec.c
View File

@ -1547,7 +1547,7 @@ static int decode_frame_lscr(AVCodecContext *avctx,
return ret;
nb_blocks = bytestream2_get_le16(gb);
if (bytestream2_get_bytes_left(gb) < 2 + nb_blocks * 12)
if (bytestream2_get_bytes_left(gb) < 2 + nb_blocks * (12 + 8))
return AVERROR_INVALIDDATA;
if (s->last_picture.f->data[0]) {