Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5466731806261248 Fixes: out of array access
Unified · Split
| @@ -1654,7 +1654,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb) · 1653 unmodified lines | |||
| 1654 | bytestream2_skip(gb, 2); | 1654 | bytestream2_skip(gb, 2); |
| 1655 | parm2 = bytestream2_get_le16u(gb); | 1655 | parm2 = bytestream2_get_le16u(gb); |
| 1656 | 1656 | ||
| 1657 | if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600) { | 1657 | if (w < 1 || h < 1 || w > 800 || h > 600 || left > 800 || top > 600 || left + w <= 0 || top + h <= 0) { |
| 1658 | av_log(ctx->avctx, AV_LOG_WARNING, | 1658 | av_log(ctx->avctx, AV_LOG_WARNING, |
| 1659 | "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n", | 1659 | "ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n", |
| 1660 | codec, w, h, left, top); | 1660 | codec, w, h, left, top); |
| @@ -1715,7 +1715,7 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb) · 54 unmodified lines | |||
| 1715 | } | 1715 | } |
| 1716 | } | 1716 | } |
| 1717 | } else { | 1717 | } else { |
| 1718 | if (((left + w > ctx->width) || (top + h > ctx->height)) && fsc) { | 1718 | if (((left + w > ctx->width) || (top + h > ctx->height)) && (fsc || codec == 20)) { |
| 1719 | /* correct unexpected overly large frames: this happens | 1719 | /* correct unexpected overly large frames: this happens |
| 1720 | * for instance with The Dig's sq1.san video: it has a few | 1720 | * for instance with The Dig's sq1.san video: it has a few |
| 1721 | * (all black) 640x480 frames halfway in, while the rest is | 1721 | * (all black) 640x480 frames halfway in, while the rest is |
| @@ -1775,11 +1775,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb) · 53 unmodified lines | |||
| 1775 | if ((w == ctx->width) && (h == ctx->height)) { | 1775 | if ((w == ctx->width) && (h == ctx->height)) { |
| 1776 | memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size); | 1776 | memcpy(ctx->fbuf, ctx->frm0, ctx->fbuf_size); |
| 1777 | } else { | 1777 | } else { |
| 1778 | uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch; | ||
| 1779 | const uint8_t *src = (uint8_t *)ctx->frm0; | 1778 | const uint8_t *src = (uint8_t *)ctx->frm0; |
| 1780 | const int cw = FFMIN(w, ctx->width - left); | 1779 | const int cw = FFMIN(w, ctx->width - left); |
| 1781 | const int ch = FFMIN(h, ctx->height - top); | 1780 | const int ch = FFMIN(h, ctx->height - top); |
| 1782 | if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) { | 1781 | if ((cw > 0) && (ch > 0) && (left >= 0) && (top >= 0)) { |
| 1782 | uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch; | ||
| 1783 | for (int i = 0; i < ch; i++) { | 1783 | for (int i = 0; i < ch; i++) { |
| 1784 | memcpy(dst, src, cw); | 1784 | memcpy(dst, src, cw); |
| 1785 | dst += ctx->pitch; | 1785 | dst += ctx->pitch; |