highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/lagarith: Detect end of input in lag_decode_line() loop

Browse Source 
Fixes: timeout
Fixes: 2933/clusterfuzz-testcase-5124990208835584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2017-08-11 21:47:31 +02:00
parent 0561bd2fc2
commit 5859b5b439
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/lagarith.c
View File

@@ -455,10 +455,12 @@ static int lag_decode_arith_plane(LagarithContext *l, uint8_t *dst,
return -1; return -1;
ff_lag_rac_init(&rac, &gb, length - stride); ff_lag_rac_init(&rac, &gb, length - stride);
for (i = 0; i < height; i++) {
for (i = 0; i < height; i++) if (rac.overread > MAX_OVERREAD)
return AVERROR_INVALIDDATA;
read += lag_decode_line(l, &rac, dst + (i * stride), width, read += lag_decode_line(l, &rac, dst + (i * stride), width,
stride, esc_count); stride, esc_count);
}
if (read > length) if (read > length)
av_log(l->avctx, AV_LOG_WARNING, av_log(l->avctx, AV_LOG_WARNING,

1
libavcodec/lagarithrac.c
View File

@@ -46,6 +46,7 @@ void ff_lag_rac_init(lag_rac *l, GetBitContext *gb, int length)
l->range = 0x80; l->range = 0x80;
l->low = *l->bytestream >> 1; l->low = *l->bytestream >> 1;
l->hash_shift = FFMAX(l->scale, 10) - 10; l->hash_shift = FFMAX(l->scale, 10) - 10;
l->overread = 0;
for (i = j = 0; i < 1024; i++) { for (i = j = 0; i < 1024; i++) {
unsigned r = i << l->hash_shift; unsigned r = i << l->hash_shift;

5
libavcodec/lagarithrac.h
View File

@@ -47,6 +47,9 @@ typedef struct lag_rac {
const uint8_t *bytestream; /**< Current position in input bytestream. */ const uint8_t *bytestream; /**< Current position in input bytestream. */
const uint8_t *bytestream_end; /**< End position of input bytestream. */ const uint8_t *bytestream_end; /**< End position of input bytestream. */
int overread;
#define MAX_OVERREAD 4
uint32_t prob[258]; /**< Table of cumulative probability for each symbol. */ uint32_t prob[258]; /**< Table of cumulative probability for each symbol. */
uint8_t range_hash[1024]; /**< Hash table mapping upper byte to approximate symbol. */ uint8_t range_hash[1024]; /**< Hash table mapping upper byte to approximate symbol. */
} lag_rac; } lag_rac;
@@ -62,6 +65,8 @@ static inline void lag_rac_refill(lag_rac *l)
l->low |= 0xff & (AV_RB16(l->bytestream) >> 1); l->low |= 0xff & (AV_RB16(l->bytestream) >> 1);
if (l->bytestream < l->bytestream_end) if (l->bytestream < l->bytestream_end)
l->bytestream++; l->bytestream++;
else
l->overread++;
} }
} }