Skip to content

Commit b0a8b40

Browse files
committed
avcodec/exr: skip bottom clearing loop when its outside the image
Fixes: signed integer overflow: 1633771809 * 32960 cannot be represented in type 'int' Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent 3e5959b commit b0a8b40

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

Diff for: libavcodec/exr.c

+7-6
Original file line numberDiff line numberDiff line change
@@ -1842,13 +1842,14 @@ static int decode_frame(AVCodecContext *avctx, void *data,
18421842

18431843
ymax = FFMAX(0, s->ymax + 1);
18441844
// Zero out the end if ymax+1 is not h
1845-
for (i = 0; i < planes; i++) {
1846-
ptr = picture->data[i] + (ymax * picture->linesize[i]);
1847-
for (y = ymax; y < avctx->height; y++) {
1848-
memset(ptr, 0, out_line_size);
1849-
ptr += picture->linesize[i];
1845+
if (ymax < avctx->height)
1846+
for (i = 0; i < planes; i++) {
1847+
ptr = picture->data[i] + (ymax * picture->linesize[i]);
1848+
for (y = ymax; y < avctx->height; y++) {
1849+
memset(ptr, 0, out_line_size);
1850+
ptr += picture->linesize[i];
1851+
}
18501852
}
1851-
}
18521853

18531854
picture->pict_type = AV_PICTURE_TYPE_I;
18541855
*got_frame = 1;

0 commit comments

Comments
 (0)