This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new a7c116b536 avcodec/mjpegdec: reject redundant scans of a sequential
image
a7c116b536 is described below
commit a7c116b536d0d64c96dd15b096aaab1a76cce3b0
Author: Michael Niedermayer <[email protected]>
AuthorDate: Wed Jul 8 02:11:44 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Sat Jul 11 02:09:25 2026 +0000
avcodec/mjpegdec: reject redundant scans of a sequential image
Fixes: Timeout
Fixes:
527085539/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_DEC_fuzzer-6502692927897600
Fixes:
523663551/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_DEC_fuzzer-5493410811936768
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/mjpegdec.c | 11 +++++++++++
libavcodec/mjpegdec.h | 1 +
2 files changed, 12 insertions(+)
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index d8430a260b..3dc8662abb 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -386,6 +386,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
}
s->nb_components = nb_components;
+ s->nb_seq_component_scans = 0;
s->h_max = 1;
s->v_max = 1;
for (i = 0; i < nb_components; i++) {
@@ -1770,6 +1771,16 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
if (s->mjpb_skiptosod)
bytestream2_skip(&s->gB, s->mjpb_skiptosod);
+ if (!s->progressive && !s->lossless &&
+ s->avctx->codec_id != AV_CODEC_ID_MXPEG) {
+ s->nb_seq_component_scans += s->nb_components_sos;
+ if (s->nb_seq_component_scans > s->nb_components) {
+ av_log(s->avctx, AV_LOG_ERROR,
+ "too many scans for a sequential image\n");
+ return AVERROR_INVALIDDATA;
+ }
+ }
+
if (s->avctx->hwaccel) {
const uint8_t *buf_ptr;
size_t buf_size;
diff --git a/libavcodec/mjpegdec.h b/libavcodec/mjpegdec.h
index 4733db3603..5ba96eaa3e 100644
--- a/libavcodec/mjpegdec.h
+++ b/libavcodec/mjpegdec.h
@@ -117,6 +117,7 @@ typedef struct MJpegDecodeContext {
AVFrame *picture; /* picture structure */
AVFrame *picture_ptr; /* pointer to picture structure */
int got_picture; ///< we found a SOF and
picture is valid, too.
+ int nb_seq_component_scans; ///< component scans
decoded since the SOF (sequential images: <= nb_components)
int linesize[MAX_COMPONENTS]; ///< linesize << interlaced
DECLARE_ALIGNED(32, int16_t, block)[64];
int16_t (*blocks[MAX_COMPONENTS])[64]; ///< intermediate sums (progressive
mode)
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
