ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-20 05:16:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/qdrw: Fix null pointer dereference

Browse Source 
The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.

Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 46b865ea9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-06-04 21:37:47 +02:00
parent cefbc513ea
commit d34d06d1e2
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/qdrw.c
View File

@ -58,6 +58,8 @@ static int parse_palette(AVCodecContext *avctx, GetByteContext *gbc,
bytestream2_skip(gbc, 6);
continue;
}
if (avctx->pix_fmt != AV_PIX_FMT_PAL8)
return AVERROR_INVALIDDATA;
r = bytestream2_get_byte(gbc);
bytestream2_skip(gbc, 1);
g = bytestream2_get_byte(gbc);
@ -378,7 +380,9 @@ static int decode_frame(AVCodecContext *avctx,
if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
return ret;
parse_palette(avctx, &gbc, (uint32_t *)p->data[1], colors);
ret = parse_palette(avctx, &gbc, (uint32_t *)p->data[1], colors);
if (ret < 0)
return ret;
p->palette_has_changed = 1;
/* jump to image data */