avcodec/qdrw: Fix null pointer dereference
authorMichael Niedermayer <michael@niedermayer.cc>
Sun, 4 Jun 2017 19:37:47 +0000 (21:37 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 5 Jun 2017 01:33:56 +0000 (03:33 +0200)
The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.

Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 46b865ea9f86cbd12e1bf701913263c7932cccb0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/qdrw.c

index 0a31b41..a7ea45f 100644 (file)
@@ -55,6 +55,8 @@ static int parse_palette(AVCodecContext *avctx, GetByteContext *gbc,
             bytestream2_skip(gbc, 6);
             continue;
         }
+        if (avctx->pix_fmt != AV_PIX_FMT_PAL8)
+            return AVERROR_INVALIDDATA;
         r = bytestream2_get_byte(gbc);
         bytestream2_skip(gbc, 1);
         g = bytestream2_get_byte(gbc);
@@ -227,7 +229,9 @@ static int decode_frame(AVCodecContext *avctx,
             if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
                 return ret;
 
-            parse_palette(avctx, &gbc, (uint32_t *)p->data[1], colors);
+            ret = parse_palette(avctx, &gbc, (uint32_t *)p->data[1], colors);
+            if (ret < 0)
+                return ret;
             p->palette_has_changed = 1;
 
             /* jump to image data */