1. ffmpeg
  2. Commit 517fd68acd7e7a5472fa3c42d2f833773fbcb5b3
Browse code

avcodec/bgmc: Check input space in ff_bgmc_decode_init()

Fixes: Infinite loop
Fixes: 16608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5636229827133440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b54031a6e93d1abc7fb2d0263e0f6c4b639e423f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Michael Niedermayer authored on 2019/09/02 05:31:45
Showing 3 changed files
libavcodec/alsdec.c
History View file @ 517fd68
... ... 
@@ -821,7 +821,9 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
821 821 
         unsigned int low;
822 822 
         unsigned int value;
823 823
824 
-        ff_bgmc_decode_init(gb, &high, &low, &value);
824 
+        int ret = ff_bgmc_decode_init(gb, &high, &low, &value);
825 
+        if (ret < 0)
826 
+            return ret;
825 827
826 828 
         current_res = bd->raw_samples + start;
827 829
libavcodec/bgmc.c
History View file @ 517fd68
... ... 
@@ -485,12 +485,17 @@ av_cold void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status)
485 485
486 486
487 487 
 /** Initialize decoding and reads the first value */
488 
-void ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
488 
+int ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
489 489 
                          unsigned int *l, unsigned int *v)
490 490 
 {
491 
+    if (get_bits_left(gb) < VALUE_BITS)
492 
+        return AVERROR_INVALIDDATA;
493 
+
491 494 
     *h = TOP_VALUE;
492 495 
     *l = 0;
493 496 
     *v = get_bits_long(gb, VALUE_BITS);
497 
+
498 
+    return 0;
494 499 
 }
495 500
496 501
libavcodec/bgmc.h
History View file @ 517fd68
... ... 
@@ -40,7 +40,7 @@ int ff_bgmc_init(AVCodecContext *avctx, uint8_t **cf_lut, int **cf_lut_status);
40 40 
 void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status);
41 41
42 42
43 
-void ff_bgmc_decode_init(GetBitContext *gb,
43 
+int ff_bgmc_decode_init(GetBitContext *gb,
44 44 
                       unsigned int *h, unsigned int *l, unsigned int *v);
45 45
46 46