[FFmpeg-devel] [PR] avcodec/bmp: Move picture allocation after some checks (PR #21673)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21673 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21673
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21673.patch

Fixes: Timeout
Fixes: 479872424/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BMP_DEC_fuzzer-5311478919135232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


>From 820ce6b5cdd2540e92d9e115197b316d93028dfb Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 7 Feb 2026 00:49:24 +0100
Subject: [PATCH 1/2] avcodec/bmp: fix indention

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/bmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/bmp.c b/libavcodec/bmp.c
index 360c103200..9e9f62d91e 100644
--- a/libavcodec/bmp.c
+++ b/libavcodec/bmp.c
@@ -129,7 +129,7 @@ static int bmp_decode_frame(AVCodecContext *avctx, AVFrame *p,
         rgb[1] = bytestream_get_le32(&buf);
         rgb[2] = bytestream_get_le32(&buf);
         if (ihsize > 40)
-        alpha = bytestream_get_le32(&buf);
+            alpha = bytestream_get_le32(&buf);
     }
 
     ret = ff_set_dimensions(avctx, width, height > 0 ? height : -(unsigned)height);
-- 
2.52.0


>From a9cbf288d3fe30d70b886d30485468d66952919f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 7 Feb 2026 00:49:37 +0100
Subject: [PATCH 2/2] avcodec/bmp: Move picture allocation after some checks

Fixes: Timeout
Fixes: 479872424/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BMP_DEC_fuzzer-5311478919135232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/bmp.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/libavcodec/bmp.c b/libavcodec/bmp.c
index 9e9f62d91e..db5d704057 100644
--- a/libavcodec/bmp.c
+++ b/libavcodec/bmp.c
@@ -207,9 +207,6 @@ static int bmp_decode_frame(AVCodecContext *avctx, AVFrame *p,
         return AVERROR_INVALIDDATA;
     }
 
-    if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
-        return ret;
-
     buf   = buf0 + hsize;
     dsize = buf_size - hsize;
 
@@ -225,6 +222,8 @@ static int bmp_decode_frame(AVCodecContext *avctx, AVFrame *p,
         }
         av_log(avctx, AV_LOG_ERROR, "data size too small, assuming missing line alignment\n");
     }
+    if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
+        return ret;
 
     // RLE may skip decoding some picture areas, so blank picture before decoding
     if (comp == BMP_RLE4 || comp == BMP_RLE8)
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org