avcodec/targaenc: Allocate space for the palette
Fixes: out of array access Fixes: 68927/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5105665067515904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
d34d4b6a7c
commit
4a7220bd5c
@ -21,6 +21,7 @@
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#include "libavutil/avassert.h"
|
||||
#include "libavutil/imgutils.h"
|
||||
#include "libavutil/internal.h"
|
||||
#include "libavutil/intreadwrite.h"
|
||||
@ -89,10 +90,11 @@ static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
|
||||
TargaContext *s = avctx->priv_data;
|
||||
int bpp, picsize, datasize = -1, ret, i;
|
||||
uint8_t *out;
|
||||
int maxpal = 32*32;
|
||||
|
||||
picsize = av_image_get_buffer_size(avctx->pix_fmt,
|
||||
avctx->width, avctx->height, 1);
|
||||
if ((ret = ff_alloc_packet(avctx, pkt, picsize + 45)) < 0)
|
||||
if ((ret = ff_alloc_packet(avctx, pkt, picsize + 45 + maxpal)) < 0)
|
||||
return ret;
|
||||
|
||||
/* zero out the header and only set applicable fields */
|
||||
@ -125,6 +127,7 @@ static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
|
||||
AV_WL24(pkt->data + 18 + 3 * i, *(uint32_t *)(p->data[1] + i * 4));
|
||||
}
|
||||
out += 32 * pal_bpp; /* skip past the palette we just output */
|
||||
av_assert0(32 * pal_bpp <= maxpal);
|
||||
break;
|
||||
}
|
||||
case AV_PIX_FMT_GRAY8:
|
||||
|
Loading…
Reference in New Issue
Block a user