This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit a303fb045931897df290d4d3547ce779fa14c628 Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Jul 8 02:11:44 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 22:59:56 2026 +0200 avcodec/mjpegdec: reject redundant scans of a sequential image Fixes: Timeout Fixes: 527085539/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_DEC_fuzzer-6502692927897600 Fixes: 523663551/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_DEC_fuzzer-5493410811936768 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit a7c116b536d0d64c96dd15b096aaab1a76cce3b0) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/mjpegdec.c | 11 +++++++++++ libavcodec/mjpegdec.h | 1 + 2 files changed, 12 insertions(+) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index d8430a260b..3dc8662abb 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -386,6 +386,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) } s->nb_components = nb_components; + s->nb_seq_component_scans = 0; s->h_max = 1; s->v_max = 1; for (i = 0; i < nb_components; i++) { @@ -1770,6 +1771,16 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s) if (s->mjpb_skiptosod) bytestream2_skip(&s->gB, s->mjpb_skiptosod); + if (!s->progressive && !s->lossless && + s->avctx->codec_id != AV_CODEC_ID_MXPEG) { + s->nb_seq_component_scans += s->nb_components_sos; + if (s->nb_seq_component_scans > s->nb_components) { + av_log(s->avctx, AV_LOG_ERROR, + "too many scans for a sequential image\n"); + return AVERROR_INVALIDDATA; + } + } + if (s->avctx->hwaccel) { const uint8_t *buf_ptr; size_t buf_size; diff --git a/libavcodec/mjpegdec.h b/libavcodec/mjpegdec.h index 4733db3603..5ba96eaa3e 100644 --- a/libavcodec/mjpegdec.h +++ b/libavcodec/mjpegdec.h @@ -117,6 +117,7 @@ typedef struct MJpegDecodeContext { AVFrame *picture; /* picture structure */ AVFrame *picture_ptr; /* pointer to picture structure */ int got_picture; ///< we found a SOF and picture is valid, too. + int nb_seq_component_scans; ///< component scans decoded since the SOF (sequential images: <= nb_components) int linesize[MAX_COMPONENTS]; ///< linesize << interlaced DECLARE_ALIGNED(32, int16_t, block)[64]; int16_t (*blocks[MAX_COMPONENTS])[64]; ///< intermediate sums (progressive mode) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
