xenia-project/FFmpeg
1
0
Fork 0
mirror of https://github.com/xenia-project/FFmpeg.git synced 2024-11-23 19:49:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

avcodec/lagarith: Detect end of input in lag_decode_line() loop

Browse Source 
Fixes: timeout
Fixes: 2933/clusterfuzz-testcase-5124990208835584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-08-11 21:47:31 +02:00
parent 0561bd2fc2
commit 5859b5b439
3 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/lagarith.c
View File

@ -455,10 +455,12 @@ static int lag_decode_arith_plane(LagarithContext *l, uint8_t *dst,
return -1;
ff_lag_rac_init(&rac, &gb, length - stride);
for (i = 0; i < height; i++)
for (i = 0; i < height; i++) {
if (rac.overread > MAX_OVERREAD)
return AVERROR_INVALIDDATA;
read += lag_decode_line(l, &rac, dst + (i * stride), width,
stride, esc_count);
}
if (read > length)
av_log(l->avctx, AV_LOG_WARNING,

1
libavcodec/lagarithrac.c
View File

@ -46,6 +46,7 @@ void ff_lag_rac_init(lag_rac *l, GetBitContext *gb, int length)
l->range = 0x80;
l->low = *l->bytestream >> 1;
l->hash_shift = FFMAX(l->scale, 10) - 10;
l->overread = 0;
for (i = j = 0; i < 1024; i++) {
unsigned r = i << l->hash_shift;

5
libavcodec/lagarithrac.h
View File

@ -47,6 +47,9 @@ typedef struct lag_rac {
const uint8_t *bytestream; /**< Current position in input bytestream. */
const uint8_t *bytestream_end; /**< End position of input bytestream. */
int overread;
#define MAX_OVERREAD 4
uint32_t prob[258]; /**< Table of cumulative probability for each symbol. */
uint8_t range_hash[1024]; /**< Hash table mapping upper byte to approximate symbol. */
} lag_rac;
@ -62,6 +65,8 @@ static inline void lag_rac_refill(lag_rac *l)
l->low |= 0xff & (AV_RB16(l->bytestream) >> 1);
if (l->bytestream < l->bytestream_end)
l->bytestream++;
else
l->overread++;
}
}