highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/pngdec: Check trns more completely

Browse Source 
Fixes out of array access
Fixes: 546/clusterfuzz-testcase-4809433909559296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-02-04 12:24:14 +01:00
parent 084f3addda
commit e477f09d0b
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/pngdec.c
View File

@ -772,6 +772,16 @@ static int decode_trns_chunk(AVCodecContext *avctx, PNGDecContext *s,
{ {
int v, i; int v, i;
if (!(s->state & PNG_IHDR)) {
av_log(avctx, AV_LOG_ERROR, "trns before IHDR\n");
return AVERROR_INVALIDDATA;
}
if (s->state & PNG_IDAT) {
av_log(avctx, AV_LOG_ERROR, "trns after IDAT\n");
return AVERROR_INVALIDDATA;
}
if (s->color_type == PNG_COLOR_TYPE_PALETTE) { if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
if (length > 256 || !(s->state & PNG_PLTE)) if (length > 256 || !(s->state & PNG_PLTE))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
@ -782,7 +792,8 @@ static int decode_trns_chunk(AVCodecContext *avctx, PNGDecContext *s,
} }
} else if (s->color_type == PNG_COLOR_TYPE_GRAY || s->color_type == PNG_COLOR_TYPE_RGB) { } else if (s->color_type == PNG_COLOR_TYPE_GRAY || s->color_type == PNG_COLOR_TYPE_RGB) {
if ((s->color_type == PNG_COLOR_TYPE_GRAY && length != 2) || if ((s->color_type == PNG_COLOR_TYPE_GRAY && length != 2) ||
(s->color_type == PNG_COLOR_TYPE_RGB && length != 6)) (s->color_type == PNG_COLOR_TYPE_RGB && length != 6) ||
s->bit_depth == 1)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
for (i = 0; i < length / 2; i++) { for (i = 0; i < length / 2; i++) {
@ -1242,6 +1253,8 @@ exit_loop:
size_t raw_bpp = s->bpp - byte_depth; size_t raw_bpp = s->bpp - byte_depth;
unsigned x, y; unsigned x, y;
av_assert0(s->bit_depth > 1);
for (y = 0; y < s->height; ++y) { for (y = 0; y < s->height; ++y) {
uint8_t *row = &s->image_buf[s->image_linesize * y]; uint8_t *row = &s->image_buf[s->image_linesize * y];