commit 4ef49fef6417340a95e961fb95e954c88c851f90
author Wan-Teh Chang <wtc@google.com> Wed Jul 18 11:51:30 2018 -0700
committer Wan-Teh Chang <wtc@google.com> Wed Jul 25 20:16:31 2018 +0000
tree c9ae61c63d1a6ecfb133308234bd099c2100d012
parent 581ed2a4ea1e33172beec1d6a624a43b11bec949

Check size limit in aom_realloc_frame_buffer.

If CONFIG_SIZE_LIMIT is defined, aom_realloc_frame_buffer should fail if
width or height is too big.

BUG=oss-fuzz:9254
BUG=oss-fuzz:9256
BUG=oss-fuzz:9468

Change-Id: Ied2fb67071b71eeffbf02860e22adbc9ebbf8553
(cherry picked from commit ebc2714d71a834fc32a19eef0a81f51fbc47db01)

aom_scale/generic/yv12config.c

diff --git a/aom_scale/generic/yv12config.c b/aom_scale/generic/yv12config.c
index 893e1cc..ca5b690 100644
--- a/aom_scale/generic/yv12config.c
+++ b/aom_scale/generic/yv12config.c
@@ -51,6 +51,10 @@
                              aom_codec_frame_buffer_t *fb,
                              aom_get_frame_buffer_cb_fn_t cb, void *cb_priv) {
   if (ybf) {
+#if CONFIG_SIZE_LIMIT
+    if (width > DECODE_WIDTH_LIMIT || height > DECODE_HEIGHT_LIMIT) return -1;
+#endif
+
     const int aom_byte_align = (byte_alignment == 0) ? 1 : byte_alignment;
     const int aligned_width = (width + 7) & ~7;
     const int aligned_height = (height + 7) & ~7;