Skip to content

Commit

Permalink
avcodec/vp3: Check width to avoid assertion failure
Browse files Browse the repository at this point in the history
Fixes: Assertion failure on x86-32
       av_assert2(block_w * sizeof(pixel) <= FFABS(buf_linesize)); in ff_emulated_edge_mc()
Fixes: 39641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5925660741206016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit dab1cd2)
Signed-off-by: Michael Niedermayer <[email protected]>
  • Loading branch information
michaelni committed Apr 15, 2023
1 parent 8ee9472 commit abddc91
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion libavcodec/vp3.c
Original file line number Diff line number Diff line change
Expand Up @@ -2332,6 +2332,8 @@ static av_cold int vp3_decode_init(AVCodecContext *avctx)
s->avctx = avctx;
s->width = FFALIGN(avctx->coded_width, 16);
s->height = FFALIGN(avctx->coded_height, 16);
if (s->width < 18)
return AVERROR_PATCHWELCOME;
if (avctx->codec_id != AV_CODEC_ID_THEORA)
avctx->pix_fmt = AV_PIX_FMT_YUV420P;
avctx->chroma_sample_location = AVCHROMA_LOC_CENTER;
Expand Down Expand Up @@ -2978,7 +2980,9 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
/* sanity check */
if (av_image_check_size(visible_width, visible_height, 0, avctx) < 0 ||
visible_width + offset_x > s->width ||
visible_height + offset_y > s->height) {
visible_height + offset_y > s->height ||
visible_width < 18
) {
av_log(avctx, AV_LOG_ERROR,
"Invalid frame dimensions - w:%d h:%d x:%d y:%d (%dx%d).\n",
visible_width, visible_height, offset_x, offset_y,
Expand Down Expand Up @@ -3024,6 +3028,8 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
} else
avctx->pix_fmt = AV_PIX_FMT_YUV420P;

if (s->width < 18)
return AVERROR_PATCHWELCOME;
ret = ff_set_dimensions(avctx, s->width, s->height);
if (ret < 0)
return ret;
Expand Down

0 comments on commit abddc91

Please sign in to comment.