highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/wmv2dec: Check input bits vs. coded MBs

Browse Source 
Fixes: Timeout (94sec ->8sec)
Fixes: 14387/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5723546887651328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-05-01 00:40:03 +02:00
parent 1cc7e2630f
commit e5ce105149
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/wmv2dec.c
View File

@ -33,6 +33,7 @@
static int parse_mb_skip(Wmv2Context *w)
{
int mb_x, mb_y;
int coded_mb_count = 0;
MpegEncContext *const s = &w->s;
uint32_t *const mb_type = s->current_picture_ptr->mb_type;
@ -83,6 +84,14 @@ static int parse_mb_skip(Wmv2Context *w)
}
break;
}
for (mb_y = 0; mb_y < s->mb_height; mb_y++)
for (mb_x = 0; mb_x < s->mb_width; mb_x++)
coded_mb_count += !IS_SKIP(mb_type[mb_y * s->mb_stride + mb_x]);
if (coded_mb_count > get_bits_left(&s->gb))
return AVERROR_INVALIDDATA;
return 0;
}