On 9/16/18, Michael Niedermayer <mich...@niedermayer.cc> wrote: > Fixes: Timeout > Fixes: > 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > --- > libavcodec/zmbv.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c > index 9e27a2caad..1133bdf7ba 100644 > --- a/libavcodec/zmbv.c > +++ b/libavcodec/zmbv.c > @@ -409,6 +409,7 @@ static int decode_frame(AVCodecContext *avctx, void > *data, int *got_frame, AVPac > int zret = Z_OK; // Zlib return code > int len = buf_size; > int hi_ver, lo_ver, ret; > + int min_size; > > /* parse header */ > if (len < 1) > @@ -510,7 +511,11 @@ static int decode_frame(AVCodecContext *avctx, void > *data, int *got_frame, AVPac > memset(c->prev, 0, avctx->width * avctx->height * (c->bpp / 8)); > c->decode_intra= decode_intra; > } > - > + if (c->flags & ZMBV_KEYFRAME) { > + min_size = avctx->width * avctx->height * (c->bpp / 8);
This is pure guessing? > + } else { > + min_size = (c->bx * c->by * 2 + 3) & ~3; > + } > if (!c->decode_intra) { > av_log(avctx, AV_LOG_ERROR, "Error! Got no format or no > keyframe!\n"); > return AVERROR_INVALIDDATA; > @@ -524,6 +529,10 @@ static int decode_frame(AVCodecContext *avctx, void > *data, int *got_frame, AVPac > av_log(avctx, AV_LOG_ERROR, "Buffer too small\n"); > return AVERROR_INVALIDDATA; > } > + if (min_size > len) { > + av_log(avctx, AV_LOG_ERROR, "input too small\n"); > + return AVERROR_INVALIDDATA; > + } > memcpy(c->decomp_buf, buf, len); > } else { // ZLIB-compressed data > c->zstream.total_in = c->zstream.total_out = 0; > -- > 2.18.0 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-devel