avcodec/iff: Check input space before loop in decode_delta_d()
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 12 Dec 2019 22:13:02 +0000 (23:13 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 18 Jan 2020 17:35:57 +0000 (18:35 +0100)
Fixes: Timeout (114sec ->108ms)
Fixes: 19290/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5740598116220928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/iff.c

index f82141d..d826e78 100644 (file)
@@ -1354,6 +1354,9 @@ static void decode_delta_d(uint8_t *dst,
         bytestream2_init(&gb, buf + ofssrc, buf_end - (buf + ofssrc));
 
         entries = bytestream2_get_be32(&gb);
+        if (entries * 8LL > bytestream2_get_bytes_left(&gb))
+            return;
+
         while (entries && bytestream2_get_bytes_left(&gb) >= 8) {
             int32_t opcode  = bytestream2_get_be32(&gb);
             unsigned offset = bytestream2_get_be32(&gb);