mirrors/librempeg
1
0
Fork 0
mirror of https://github.com/librempeg/librempeg synced 2024-11-23 11:39:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/cavsdec: Check bits left before picture allocation

Browse Source 
Fixes: Timeout
Fixes: 57893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5091726540013568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-04-24 00:15:04 +02:00
parent f6dffe6fc4
commit e734e16544
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavcodec/cavsdec.c
View File

@ -1020,6 +1020,9 @@ static int decode_pic(AVSContext *h)
skip_bits(&h->gb, 1); //marker_bit skip_bits(&h->gb, 1); //marker_bit
} }
if (get_bits_left(&h->gb) < 23)
return AVERROR_INVALIDDATA;
ret = ff_get_buffer(h->avctx, h->cur.f, h->cur.f->pict_type == AV_PICTURE_TYPE_B ? ret = ff_get_buffer(h->avctx, h->cur.f, h->cur.f->pict_type == AV_PICTURE_TYPE_B ?
0 : AV_GET_BUFFER_FLAG_REF); 0 : AV_GET_BUFFER_FLAG_REF);
if (ret < 0) if (ret < 0)