Skip to content

Commit

Permalink
avcodec/dfa: Check dimension against maximum
Browse files Browse the repository at this point in the history
The headers from where the dimensions are read in actual files
are limited to 16bit per component.

Fixes: Timeout
Fixes: 6305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-4824270749302784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  • Loading branch information
michaelni committed Apr 19, 2018
1 parent 9033920 commit 9d5a4fc
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion libavcodec/dfa.c
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ static av_cold int dfa_decode_init(AVCodecContext *avctx)

avctx->pix_fmt = AV_PIX_FMT_PAL8;

if (!avctx->width || !avctx->height)
if (!avctx->width || !avctx->height || FFMAX(avctx->width, avctx->height) >= (1<<16))
return AVERROR_INVALIDDATA;

av_assert0(av_image_check_size(avctx->width, avctx->height, 0, avctx) >= 0);
Expand Down

0 comments on commit 9d5a4fc

Please sign in to comment.