This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 206f2d92db avcodec/exr: bound total decoded pixels by max_pixels
206f2d92db is described below
commit 206f2d92db2e67914cb417b9e1efac191c3b0690
Author: Michael Niedermayer <[email protected]>
AuthorDate: Tue Jul 7 23:48:04 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Mon Jul 13 00:57:26 2026 +0000
avcodec/exr: bound total decoded pixels by max_pixels
Use the maximum block dimensions decode_block() can assign after clipping
the nominal tile or scanline block to the data window.
Fixes: Timeout
Fixes:
521392254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6740984590565376
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/exr.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index bef1d62485..0e9c734a10 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -2229,6 +2229,16 @@ static int decode_frame(AVCodecContext *avctx, AVFrame
*picture,
if (bytestream2_get_bytes_left(gb)/8 < nb_blocks)
return AVERROR_INVALIDDATA;
+ if (avctx->max_pixels) {
+ int64_t block_pixels = s->is_tile
+ ? (int64_t)FFMIN(s->tile_attr.xSize, s->xdelta) *
+ FFMIN(s->tile_attr.ySize, s->ydelta)
+ : (int64_t)s->xdelta *
+ FFMIN(s->scan_lines_per_block, s->ydelta);
+ if (nb_blocks > avctx->max_pixels / FFMAX(block_pixels, 1))
+ return AVERROR_INVALIDDATA;
+ }
+
// check offset table and recreate it if need
if (!s->is_tile && bytestream2_peek_le64(gb) == 0) {
PutByteContext offset_table_writer;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
