diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-08 22:38:11 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-23 22:26:50 +0200 |
| commit | 1c9a56b13965ea9691185f6199df4eca7be993c7 (patch) | |
| tree | 2af3e3e197a5afc83da1aa437b5811114e8df91d /libavcodec/smacker.c | |
| parent | 5231e89eb9eedc119d4f762469355f83e3628f20 (diff) | |
avcodec/smacker: Check that not all tables are skiped
If all tables are skipped it would be impossible to encode any
"non black" video.
Fixes: Timeout (78sec -> 1ms)
Fixes: 15821/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5652598838788096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/smacker.c')
| -rw-r--r-- | libavcodec/smacker.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index 61e316916b..70e0dfd5df 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -319,6 +319,7 @@ error: static int decode_header_trees(SmackVContext *smk) { GetBitContext gb; int mmap_size, mclr_size, full_size, type_size, ret; + int skip = 0; mmap_size = AV_RL32(smk->avctx->extradata); mclr_size = AV_RL32(smk->avctx->extradata + 4); @@ -330,6 +331,7 @@ static int decode_header_trees(SmackVContext *smk) { return ret; if(!get_bits1(&gb)) { + skip ++; av_log(smk->avctx, AV_LOG_INFO, "Skipping MMAP tree\n"); smk->mmap_tbl = av_malloc(sizeof(int) * 2); if (!smk->mmap_tbl) @@ -342,6 +344,7 @@ static int decode_header_trees(SmackVContext *smk) { return ret; } if(!get_bits1(&gb)) { + skip ++; av_log(smk->avctx, AV_LOG_INFO, "Skipping MCLR tree\n"); smk->mclr_tbl = av_malloc(sizeof(int) * 2); if (!smk->mclr_tbl) @@ -354,6 +357,7 @@ static int decode_header_trees(SmackVContext *smk) { return ret; } if(!get_bits1(&gb)) { + skip ++; av_log(smk->avctx, AV_LOG_INFO, "Skipping FULL tree\n"); smk->full_tbl = av_malloc(sizeof(int) * 2); if (!smk->full_tbl) @@ -366,6 +370,7 @@ static int decode_header_trees(SmackVContext *smk) { return ret; } if(!get_bits1(&gb)) { + skip ++; av_log(smk->avctx, AV_LOG_INFO, "Skipping TYPE tree\n"); smk->type_tbl = av_malloc(sizeof(int) * 2); if (!smk->type_tbl) @@ -377,6 +382,8 @@ static int decode_header_trees(SmackVContext *smk) { if (ret < 0) return ret; } + if (skip == 4) + return AVERROR_INVALIDDATA; return 0; } |