[FFmpeg-devel] [PATCH 3/4] avcodec/mobiclip: Check input size before (re)allocation

[Shiyou Yin]

Please ignore fail info form loongarch64 patchwork temporarily.
I have stoped the service from Nov 16th, but there are still result post to patchwork.
Have mailed to Andriy to help analyze this problem together.

> 2022年11月19日 05:09，Michael Niedermayer <michael at niedermayer.cc> 写道：
> 
> Fixes: Timeout
> Fixes: 52566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-4913160050311168
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
> libavcodec/mobiclip.c | 3 +++
> 1 file changed, 3 insertions(+)
> 
> diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c
> index aca462428c..c3b2383dbc 100644
> --- a/libavcodec/mobiclip.c
> +++ b/libavcodec/mobiclip.c
> @@ -1216,6 +1216,9 @@ static int mobiclip_decode(AVCodecContext *avctx, AVFrame *rframe,
>     AVFrame *frame = s->pic[s->current_pic];
>     int ret;
> 
> +    if (avctx->height/16 * (avctx->width/16) * 2 > 8LL*FFALIGN(pkt->size, 2))
> +        return AVERROR_INVALIDDATA;
> +
>     av_fast_padded_malloc(&s->bitstream, &s->bitstream_size,
>                           pkt->size);
> 
> -- 
> 2.17.1
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".