Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/vp7: Check for end of input in vp78_decode_mv_mb_modes()

Browse Source 
Fixes: Timeout
Fixes: 10313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP7_fuzzer-5637719389110272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/304/head^2
Michael Niedermayer 6 years ago
parent 3a95b73abc
commit b11b3d2585
1 changed files with 14 additions and 7 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 21
      libavcodec/vp8.c

21
libavcodec/vp8.c
Unescape View File

@ -2268,7 +2268,7 @@ void filter_mb_simple(VP8Context *s, uint8_t *dst, VP8FilterStrength *f,
#define MARGIN (16 << 2) #define MARGIN (16 << 2)
static av_always_inline static av_always_inline
void vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe, int vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe,
VP8Frame *prev_frame, int is_vp7) VP8Frame *prev_frame, int is_vp7)
{ {
VP8Context *s = avctx->priv_data; VP8Context *s = avctx->priv_data;
@ -2285,6 +2285,10 @@ void vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe,
s->mv_bounds.mv_min.x = -MARGIN; s->mv_bounds.mv_min.x = -MARGIN;
s->mv_bounds.mv_max.x = ((s->mb_width - 1) << 6) + MARGIN; s->mv_bounds.mv_max.x = ((s->mb_width - 1) << 6) + MARGIN;
if (vpX_rac_is_end(&s->c)) {
return AVERROR_INVALIDDATA;
}
for (mb_x = 0; mb_x < s->mb_width; mb_x++, mb_xy++, mb++) { for (mb_x = 0; mb_x < s->mb_width; mb_x++, mb_xy++, mb++) {
if (mb_y == 0) if (mb_y == 0)
AV_WN32A((mb - s->mb_width - 1)->intra4x4_pred_mode_top, AV_WN32A((mb - s->mb_width - 1)->intra4x4_pred_mode_top,
@ -2298,18 +2302,19 @@ void vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe,
s->mv_bounds.mv_min.y -= 64; s->mv_bounds.mv_min.y -= 64;
s->mv_bounds.mv_max.y -= 64; s->mv_bounds.mv_max.y -= 64;
} }
return 0;
} }
static void vp7_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *cur_frame, static int vp7_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *cur_frame,
VP8Frame *prev_frame) VP8Frame *prev_frame)
{ {
vp78_decode_mv_mb_modes(avctx, cur_frame, prev_frame, IS_VP7); return vp78_decode_mv_mb_modes(avctx, cur_frame, prev_frame, IS_VP7);
} }
static void vp8_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *cur_frame, static int vp8_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *cur_frame,
VP8Frame *prev_frame) VP8Frame *prev_frame)
{ {
vp78_decode_mv_mb_modes(avctx, cur_frame, prev_frame, IS_VP8); return vp78_decode_mv_mb_modes(avctx, cur_frame, prev_frame, IS_VP8);
} }
#if HAVE_THREADS #if HAVE_THREADS
@ -2744,9 +2749,11 @@ int vp78_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
!s->segmentation.update_map) !s->segmentation.update_map)
ff_thread_await_progress(&prev_frame->tf, 1, 0); ff_thread_await_progress(&prev_frame->tf, 1, 0);
if (is_vp7) if (is_vp7)
vp7_decode_mv_mb_modes(avctx, curframe, prev_frame); ret = vp7_decode_mv_mb_modes(avctx, curframe, prev_frame);
else else
vp8_decode_mv_mb_modes(avctx, curframe, prev_frame); ret = vp8_decode_mv_mb_modes(avctx, curframe, prev_frame);
if (ret < 0)
goto err;
} }
if (avctx->active_thread_type == FF_THREAD_FRAME) if (avctx->active_thread_type == FF_THREAD_FRAME)

Write Preview
Loading…
Cancel
Save