From 960f93f36469255c470a8748c8a868097517bd33 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 23 Oct 2019 23:31:03 +0200 Subject: [PATCH] avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta() Fixes: Timeout (31sec -> 41ms) Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 32b3c8ce7d050210d210511cdb8c6644664a70ab) Signed-off-by: Michael Niedermayer --- libavcodec/iff.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/iff.c b/libavcodec/iff.c index 1bb7924c98..3d9ce9d29c 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -1143,6 +1143,9 @@ static void decode_long_vertical_delta(uint8_t *dst, x = bytestream2_get_be32(&dgb); } + if (ofsdst + (opcode - 1LL) * dstpitch > bytestream2_size_p(&pb)) + return; + while (opcode) { bytestream2_seek_p(&pb, ofsdst, SEEK_SET); if (h && (j == (ncolumns - 1))) { @@ -1283,6 +1286,9 @@ static void decode_long_vertical_delta2(uint8_t *dst, x = bytestream2_get_be32(&gb); } + if (ofsdst + (opcode - 1LL) * dstpitch > bytestream2_size_p(&pb)) + return; + while (opcode && bytestream2_get_bytes_left_p(&pb) > 1) { bytestream2_seek_p(&pb, ofsdst, SEEK_SET); if (h && (j == ncolumns - 1))