Commit f603c70284 for ffmpeg
commit f603c70284cddbb415644b447abe820368c01b16
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat Oct 10 18:05:42 2026 +0200
avcodec/txd: reject unsupported d3d formats before allocating the frame
Timeout Replicated through Modified FFmpeg (fuzzer harness built with --disable-asm)
Fixes: Timeout
Fixes: 505670915/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5106192354705408
Fixes: qiaJQYzDp7vx
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff --git a/libavcodec/txd.c b/libavcodec/txd.c
index 24a6b6b5d3..2f175fc696 100644
--- a/libavcodec/txd.c
+++ b/libavcodec/txd.c
@@ -81,9 +81,14 @@ static int txd_decode_frame(AVCodecContext *avctx, AVFrame *p,
case TXD_DXT3:
if (bytestream2_get_bytes_left(&gb) < AV_CEIL_RSHIFT(w, 2) * AV_CEIL_RSHIFT(h, 2) * 16 + 4)
return AVERROR_INVALIDDATA;
+ break;
+ default:
+ goto unsupported;
}
} else if (depth == 32) {
avctx->pix_fmt = AV_PIX_FMT_RGBA;
+ if (d3d_format != 0x15 && d3d_format != 0x16)
+ goto unsupported;
if (bytestream2_get_bytes_left(&gb) < h * w * 4)
return AVERROR_INVALIDDATA;
} else {