[FFmpeg-devel] [PATCH] avcodec/cpia: Check input size also against linesizes and EOL

[Carl Eugen Hoyos]

Am So., 19. Mai 2019 um 17:43 Uhr schrieb Michael Niedermayer
<michael at niedermayer.cc>:
>
> Fixes: Timeout (14sec -> 29ms)
> Fixes: 14733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5707022445576192
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/cpia.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/cpia.c b/libavcodec/cpia.c
> index 119969389e..2e78fcff7a 100644
> --- a/libavcodec/cpia.c
> +++ b/libavcodec/cpia.c
> @@ -63,7 +63,7 @@ static int cpia_decode_frame(AVCodecContext *avctx,
>      uint8_t *y, *u, *v;
>
>      // Check header
> -    if ( avpkt->size < FRAME_HEADER_SIZE
> +    if ( avpkt->size < FRAME_HEADER_SIZE + avctx->height*3

lgtm except for the missing whitespace that is constantly present in the file.

Carl Eugen