avcodec/mpeg12dec: Check input size

Fixes: Timeout Fixes: 53599/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IPU_fuzzer-4950102511058944

Michael Niedermayer committed 3 years ago

Commit 7c130d61 parent f669dd41 file · +4 −0Browse files

Unified · Split

@@ -2956,6 +2956,10 @@ static int ipu_decode_frame(AVCodecContext avctx, AVFrame frame, · 2955 unmodified lines
2956	2956	GetBitContext *gb = &m->gb;
2957	2957	int ret;
2958	2958
	2959	+ // Check for minimal intra MB size (considering mb header, luma & chroma dc VLC, ac EOB VLC)
	2960	+ if (avpkt->size8LL < (avctx->width+15)/16 ((avctx->height+15)/16) * (2 + 34 + 22 + 2*6))
	2961	+ return AVERROR_INVALIDDATA;
	2962	+
2959	2963	ret = ff_get_buffer(avctx, frame, 0);
2960	2964	if (ret < 0)
2961	2965	return ret;

Keyboard shortcuts