sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/mjpegdec: reject redundant scans of a sequential image

Browse Source 
Fixes: Timeout
Fixes: 527085539/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_DEC_fuzzer-6502692927897600
Fixes: 523663551/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_DEC_fuzzer-5493410811936768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7c116b536)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-07-08 02:11:44 +02:00
parent 7bd23e2cb2
commit a303fb0459
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/mjpegdec.c
View File

@@ -386,6 +386,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
}
s->nb_components = nb_components;
s->nb_seq_component_scans = 0;
s->h_max = 1;
s->v_max = 1;
for (i = 0; i < nb_components; i++) {
@@ -1770,6 +1771,16 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
if (s->mjpb_skiptosod)
bytestream2_skip(&s->gB, s->mjpb_skiptosod);
if (!s->progressive && !s->lossless &&
s->avctx->codec_id != AV_CODEC_ID_MXPEG) {
s->nb_seq_component_scans += s->nb_components_sos;
if (s->nb_seq_component_scans > s->nb_components) {
av_log(s->avctx, AV_LOG_ERROR,
"too many scans for a sequential image\n");
return AVERROR_INVALIDDATA;
}
}
if (s->avctx->hwaccel) {
const uint8_t *buf_ptr;
size_t buf_size;

1
libavcodec/mjpegdec.h
View File

@@ -117,6 +117,7 @@ typedef struct MJpegDecodeContext {
AVFrame *picture; /* picture structure */
AVFrame *picture_ptr; /* pointer to picture structure */
int got_picture; ///< we found a SOF and picture is valid, too.
int nb_seq_component_scans; ///< component scans decoded since the SOF (sequential images: <= nb_components)
int linesize[MAX_COMPONENTS]; ///< linesize << interlaced
DECLARE_ALIGNED(32, int16_t, block)[64];
int16_t (*blocks[MAX_COMPONENTS])[64]; ///< intermediate sums (progressive mode)