[FFmpeg-devel] [PR] avcodec/pnmdec: Check input size against width*height assuming at least 1bit per pixel (PR #21672)

[FFmpeg-devel] [PR] avcodec/pnmdec: Check input size against width*height assuming at least 1bit per pixel (PR #21672)

[michaelni via ffmpeg-devel]

PR #21672 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21672
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21672.patch

Fixes: Timeout
Fixes: 481427018/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PHM_DEC_fuzzer-6315469467615232

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From b14045627831592cc4013424a7e93c186fd927db Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 7 Feb 2026 00:35:29 +0100
Subject: [PATCH] avcodec/pnmdec: Check input size against width*height
 assuming at least 1bit per pixel

Fixes: Timeout
Fixes: 481427018/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PHM_DEC_fuzzer-6315469467615232

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/pnmdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/pnmdec.c b/libavcodec/pnmdec.c
index 68bb7a41ec..b99b26a390 100644
--- a/libavcodec/pnmdec.c
+++ b/libavcodec/pnmdec.c
@@ -63,6 +63,9 @@ static int pnm_decode_frame(AVCodecContext *avctx, AVFrame *p,
     if (avctx->skip_frame >= AVDISCARD_ALL)
         return avpkt->size;
 
+    if (avctx->width * avctx->height / 8 > s->bytestream_end - s->bytestream)
+        return AVERROR_INVALIDDATA;
+
     if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
         return ret;
     avctx->bits_per_raw_sample = av_log2(s->maxval) + 1;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org