From 68f8292aa96d99b733ca7d2e56b584b00263db84 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 23 Dec 2021 20:17:14 +0100 Subject: [PATCH] avcodec/targa: Check input size for uncompressed TGA before allocation Fixes: Timeout Fixes: 42667/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5619236075077632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/targa.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/libavcodec/targa.c b/libavcodec/targa.c index 221fcc956d..b0048621d3 100644 --- a/libavcodec/targa.c +++ b/libavcodec/targa.c @@ -117,6 +117,7 @@ static int decode_frame(AVCodecContext *avctx, int idlen, pal, compr, y, w, h, bpp, flags, ret; int first_clr, colors, csize; int interleave; + size_t img_size; bytestream2_init(&s->gb, avpkt->data, avpkt->size); @@ -180,6 +181,15 @@ static int decode_frame(AVCodecContext *avctx, return avpkt->size; } + if (!(compr & TGA_RLE)) { + img_size = w * ((bpp + 1) >> 3); + if (bytestream2_get_bytes_left(&s->gb) < img_size * h) { + av_log(avctx, AV_LOG_ERROR, + "Not enough data available for image\n"); + return AVERROR_INVALIDDATA; + } + } + if ((ret = ff_get_buffer(avctx, p, 0)) < 0) return ret; p->pict_type = AV_PICTURE_TYPE_I; @@ -251,7 +261,6 @@ static int decode_frame(AVCodecContext *avctx, if (res < 0) return res; } else { - size_t img_size = w * ((bpp + 1) >> 3); uint8_t *line; if (bytestream2_get_bytes_left(&s->gb) < img_size * h) { av_log(avctx, AV_LOG_ERROR,