From 206f2d92db2e67914cb417b9e1efac191c3b0690 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 7 Jul 2026 23:48:04 +0200 Subject: [PATCH] avcodec/exr: bound total decoded pixels by max_pixels Use the maximum block dimensions decode_block() can assign after clipping the nominal tile or scanline block to the data window. Fixes: Timeout Fixes: 521392254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6740984590565376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/exr.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index bef1d62485..0e9c734a10 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -2229,6 +2229,16 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture, if (bytestream2_get_bytes_left(gb)/8 < nb_blocks) return AVERROR_INVALIDDATA; + if (avctx->max_pixels) { + int64_t block_pixels = s->is_tile + ? (int64_t)FFMIN(s->tile_attr.xSize, s->xdelta) * + FFMIN(s->tile_attr.ySize, s->ydelta) + : (int64_t)s->xdelta * + FFMIN(s->scan_lines_per_block, s->ydelta); + if (nb_blocks > avctx->max_pixels / FFMAX(block_pixels, 1)) + return AVERROR_INVALIDDATA; + } + // check offset table and recreate it if need if (!s->is_tile && bytestream2_peek_le64(gb) == 0) { PutByteContext offset_table_writer;