dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 17:39:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/exr: bound total decoded pixels by max_pixels

Browse Source 
Use the maximum block dimensions decode_block() can assign after clipping
the nominal tile or scanline block to the data window.

Fixes: Timeout
Fixes: 521392254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6740984590565376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-07-07 23:48:04 +02:00
committed by michaelni
parent a13c2b1e4f
commit 206f2d92db
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/exr.c
View File

@@ -2229,6 +2229,16 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture,
if (bytestream2_get_bytes_left(gb)/8 < nb_blocks)
return AVERROR_INVALIDDATA;
if (avctx->max_pixels) {
int64_t block_pixels = s->is_tile
? (int64_t)FFMIN(s->tile_attr.xSize, s->xdelta) *
FFMIN(s->tile_attr.ySize, s->ydelta)
: (int64_t)s->xdelta *
FFMIN(s->scan_lines_per_block, s->ydelta);
if (nb_blocks > avctx->max_pixels / FFMAX(block_pixels, 1))
return AVERROR_INVALIDDATA;
}
// check offset table and recreate it if need
if (!s->is_tile && bytestream2_peek_le64(gb) == 0) {
PutByteContext offset_table_writer;