On 6/4/2020 3:40 PM, Thierry Foucu wrote:
> target_dec_fuzzer is checking for the avpkt.data pointer but if the
> png parser cannot combine the frame, the poutbuf is not set and so, the
> avpkt.data is not initialized.
> ---
> libavcodec/png_parser.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/libavcodec/png_parser.c b/libavcodec/png_parser.c
> index 74f2964118..d1b2926154 100644
> --- a/libavcodec/png_parser.c
> +++ b/libavcodec/png_parser.c
> @@ -99,8 +99,11 @@ static int png_parse(AVCodecParserContext *s,
> AVCodecContext *avctx,
> }
>
> flush:
> - if (ff_combine_frame(&ppc->pc, next, &buf, &buf_size) < 0)
> + if (ff_combine_frame(&ppc->pc, next, &buf, &buf_size) < 0) {
> + *poutbuf = NULL;
> + *poutbuf_size = 0;
This is already set to 0 first thing in png_parse(), so i'd say we
should also set *poutbuf to NULL there instead.
And I see the BMP parser has the same issue, so it needs the same fix.
> return buf_size;
> + }
>
> ppc->chunk_pos = ppc->pc.frame_start_found = 0;
>
>
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
