diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2025-07-16 00:01:07 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2025-07-20 01:05:23 +0200 |
| commit | 051e0d7744dbb45f680bbfa72bfead947b11ef2f (patch) | |
| tree | a0ef60104377ec5661d612a6deb1353b5976ab93 | |
| parent | c0f1c3e18579c249cc729bc6033c034f6a6f7426 (diff) | |
| download | ffmpeg-051e0d7744dbb45f680bbfa72bfead947b11ef2f.tar.gz | |
avcodec/ffv1dec: Check k in get_vlc_symbol()
The true problem happens in several previous get_vlc_symbol()
but checking that is more expensive (involving FFABS())
here its just a simple check between 2 variables we have.
Fixes: Assertion log >= k failed at libavcodec/golomb.h:406
Fixes: 429296194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_DEC_fuzzer-4691594622337024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/ffv1dec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index d613aa5395..d709e8ccbb 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -56,6 +56,11 @@ static inline int get_vlc_symbol(GetBitContext *gb, VlcState *const state, k++; i += i; } + if (k > bits) { + ff_dlog(NULL, "k-overflow bias:%d error:%d drift:%d count:%d k:%d", + state->bias, state->error_sum, state->drift, state->count, k); + k = bits; + } v = get_sr_golomb(gb, k, 12, bits); ff_dlog(NULL, "v:%d bias:%d error:%d drift:%d count:%d k:%d", |