PR #23755 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23755 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23755.patch
Fixes: Timeout Fixes: 521392254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6740984590565376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From 5a2e7747ccc1271e4a6cf760f7e76981b706da10 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 7 Jul 2026 23:48:04 +0200 Subject: [PATCH] avcodec/exr: bound total decoded pixels by max_pixels Fixes: Timeout Fixes: 521392254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6740984590565376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/exr.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index bef1d62485..c5e2aabeab 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -2229,6 +2229,14 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture, if (bytestream2_get_bytes_left(gb)/8 < nb_blocks) return AVERROR_INVALIDDATA; + if (avctx->max_pixels) { + int64_t block_pixels = s->is_tile + ? (int64_t)s->tile_attr.xSize * s->tile_attr.ySize + : (int64_t)s->xdelta * s->scan_lines_per_block; + if (nb_blocks > avctx->max_pixels / FFMAX(block_pixels, 1)) + return AVERROR_INVALIDDATA; + } + // check offset table and recreate it if need if (!s->is_tile && bytestream2_peek_le64(gb) == 0) { PutByteContext offset_table_writer; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
