Re: [FFmpeg-devel] [PATCH] avcodec/diracdec: Correct max pixels check

[Michael Niedermayer]

On Mon, Feb 25, 2019 at 10:35:11PM +0100, Michael Niedermayer wrote:
> Dirac internally allocates 5 images per plane and frame currently. One being 
> the actual
> image the other 4 being filtered for motion compensation.
> 
> Fixes: Out of memory
> Fixes: 
> 12870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5684825871089664
> 
> Found-by: continuous fuzzing process 
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/diracdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

will apply

[...]
-- 
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

"I am not trying to be anyone's saviour, I'm trying to think about the
 future and not be sad" - Elon Musk



signature.asc
Description: PGP signature
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH] avcodec/diracdec: Correct max pixels check

[Michael Niedermayer]

Dirac internally allocates 5 images per plane and frame currently. One being 
the actual
image the other 4 being filtered for motion compensation.

Fixes: Out of memory
Fixes: 
12870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5684825871089664

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
---
 libavcodec/diracdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index db010b49cf..30b4bfad79 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -2137,7 +2137,7 @@ static int dirac_decode_data_unit(AVCodecContext *avctx, 
const uint8_t *buf, int
 return ret;
 }
 
-if (CALC_PADDING((int64_t)dsh->width, MAX_DWT_LEVELS) * 
CALC_PADDING((int64_t)dsh->height, MAX_DWT_LEVELS) > avctx->max_pixels)
+if (CALC_PADDING((int64_t)dsh->width, MAX_DWT_LEVELS) * 
CALC_PADDING((int64_t)dsh->height, MAX_DWT_LEVELS) * 5LL > avctx->max_pixels)
 ret = AVERROR(ERANGE);
 if (ret >= 0)
 ret = ff_set_dimensions(avctx, dsh->width, dsh->height);
-- 
2.20.1

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel