diff options
author | Michael Niedermayer <michael@niedermayer.cc> | 2018-11-20 01:47:13 +0300 |
---|---|---|
committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-11-21 02:33:38 +0300 |
commit | 77bf85515e59f7b17685fbbec943ff46f6217719 (patch) | |
tree | 8cdf24858d83ea599777f408bf6c73a73e857053 /libavcodec/truemotion2.c | |
parent | 3fc7b69496fd586a609f9c8a2f1ed17e46bf5fff (diff) |
avcodec/truemotion2: Check huffman code max bits
Fixes: Timeout
Fixes: 10984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6643310750859264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/truemotion2.c')
-rw-r--r-- | libavcodec/truemotion2.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index 58a577f53c..6d58483a77 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -112,9 +112,13 @@ typedef struct TM2Huff { int *lens; ///< codelengths } TM2Huff; +/** + * + * @returns the length of the longest code or an AVERROR code + */ static int tm2_read_tree(TM2Context *ctx, uint32_t prefix, int length, TM2Huff *huff) { - int ret; + int ret, ret2; if (length > huff->max_bits) { av_log(ctx->avctx, AV_LOG_ERROR, "Tree exceeded its given depth (%i)\n", huff->max_bits); @@ -133,14 +137,14 @@ static int tm2_read_tree(TM2Context *ctx, uint32_t prefix, int length, TM2Huff * huff->bits[huff->num] = prefix; huff->lens[huff->num] = length; huff->num++; - return 0; + return length; } else { /* non-terminal node */ - if ((ret = tm2_read_tree(ctx, prefix << 1, length + 1, huff)) < 0) - return ret; + if ((ret2 = tm2_read_tree(ctx, prefix << 1, length + 1, huff)) < 0) + return ret2; if ((ret = tm2_read_tree(ctx, (prefix << 1) | 1, length + 1, huff)) < 0) return ret; } - return 0; + return FFMAX(ret, ret2); } static int tm2_build_huff_table(TM2Context *ctx, TM2Codes *code) @@ -183,6 +187,11 @@ static int tm2_build_huff_table(TM2Context *ctx, TM2Codes *code) res = tm2_read_tree(ctx, 0, 0, &huff); + if (res >= 0 && res != huff.max_bits) { + av_log(ctx->avctx, AV_LOG_ERROR, "Got less bits than expected: %i of %i\n", + res, huff.max_bits); + res = AVERROR_INVALIDDATA; + } if (huff.num != huff.max_num) { av_log(ctx->avctx, AV_LOG_ERROR, "Got less codes than expected: %i of %i\n", huff.num, huff.max_num); |