PR #23756 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23756 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23756.patch
Fixes: Timeout Fixes: 527085539/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_DEC_fuzzer-6502692927897600 Fixes: 523663551/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_DEC_fuzzer-5493410811936768 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From 6da64f0faf49ac5f3680ce5243d0a8be7c47e823 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 8 Jul 2026 02:11:44 +0200 Subject: [PATCH] avcodec/mjpegdec: reject redundant scans of a sequential image Fixes: Timeout Fixes: 527085539/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_DEC_fuzzer-6502692927897600 Fixes: 523663551/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_DEC_fuzzer-5493410811936768 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/mjpegdec.c | 11 +++++++++++ libavcodec/mjpegdec.h | 1 + 2 files changed, 12 insertions(+) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index d8430a260b..3dc8662abb 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -386,6 +386,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) } s->nb_components = nb_components; + s->nb_seq_component_scans = 0; s->h_max = 1; s->v_max = 1; for (i = 0; i < nb_components; i++) { @@ -1770,6 +1771,16 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s) if (s->mjpb_skiptosod) bytestream2_skip(&s->gB, s->mjpb_skiptosod); + if (!s->progressive && !s->lossless && + s->avctx->codec_id != AV_CODEC_ID_MXPEG) { + s->nb_seq_component_scans += s->nb_components_sos; + if (s->nb_seq_component_scans > s->nb_components) { + av_log(s->avctx, AV_LOG_ERROR, + "too many scans for a sequential image\n"); + return AVERROR_INVALIDDATA; + } + } + if (s->avctx->hwaccel) { const uint8_t *buf_ptr; size_t buf_size; diff --git a/libavcodec/mjpegdec.h b/libavcodec/mjpegdec.h index 4733db3603..5ba96eaa3e 100644 --- a/libavcodec/mjpegdec.h +++ b/libavcodec/mjpegdec.h @@ -117,6 +117,7 @@ typedef struct MJpegDecodeContext { AVFrame *picture; /* picture structure */ AVFrame *picture_ptr; /* pointer to picture structure */ int got_picture; ///< we found a SOF and picture is valid, too. + int nb_seq_component_scans; ///< component scans decoded since the SOF (sequential images: <= nb_components) int linesize[MAX_COMPONENTS]; ///< linesize << interlaced DECLARE_ALIGNED(32, int16_t, block)[64]; int16_t (*blocks[MAX_COMPONENTS])[64]; ///< intermediate sums (progressive mode) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
