avcodec/vmnc: Check available space against chunks before reget_buffer()
authorMichael Niedermayer <michael@niedermayer.cc>
Fri, 17 May 2019 21:28:49 +0000 (23:28 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 27 Jun 2019 15:50:47 +0000 (17:50 +0200)
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 279d9a84af37cc1a7cf79c1cd667105eeb948611)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/vmnc.c

index 30b1414..e273043 100644 (file)
@@ -333,11 +333,15 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     uint8_t *outptr;
     int dx, dy, w, h, depth, enc, chunks, res, size_left, ret;
 
+    bytestream2_init(gb, buf, buf_size);
+    bytestream2_skip(gb, 2);
+    chunks = bytestream2_get_be16(gb);
+    if (12LL * chunks > bytestream2_get_bytes_left(gb))
+        return AVERROR_INVALIDDATA;
+
     if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
         return ret;
 
-    bytestream2_init(gb, buf, buf_size);
-
     c->pic->key_frame = 0;
     c->pic->pict_type = AV_PICTURE_TYPE_P;
 
@@ -369,8 +373,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             }
         }
     }
-    bytestream2_skip(gb, 2);
-    chunks = bytestream2_get_be16(gb);
+
     while (chunks--) {
         if (bytestream2_get_bytes_left(gb) < 12) {
             av_log(avctx, AV_LOG_ERROR, "Premature end of data!\n");