shithub: dav1d

Info  •  Files  •  Log  •  Branches

decode: verify inter frame size restrictions

Fixes a heap buffer overflow in
clusterfuzz-testcase-minimized-dav1d_fuzzer-5677513716531200. Credits to
oss-fuzz.

--- a/src/decode.c

+++ b/src/decode.c

@@ -2775,7 +2775,10 @@

         }

         for (int i = 0; i < 7; i++) {

             const int refidx = f->frame_hdr.refidx[i];

-            if (!c->refs[refidx].p.p.data[0]) {

+            if (!c->refs[refidx].p.p.data[0] ||

+                f->frame_hdr.width  != c->refs[refidx].p.p.p.w ||

+                f->frame_hdr.height != c->refs[refidx].p.p.p.h)

+            {

                 for (int j = 0; j < i; j++)

                     dav1d_thread_picture_unref(&f->refp[j]);

                 return -EINVAL;