diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-17 02:06:49 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-17 02:07:17 +0200 |
| commit | 0e87c07d87b474568e82364ae0d4a3928801e2b2 (patch) | |
| tree | 965acb0e83d40a29064f88cdbf8651beb5064b89 | |
| parent | 355e27e24dc88d6ba8f27501a34925d9d937a399 (diff) | |
| download | ffmpeg-0e87c07d87b474568e82364ae0d4a3928801e2b2.tar.gz | |
avcodec/h264_cavlc: Fix runtime error: index -1 out of bounds for type 'VLC [6]'
Fixes: 1639/clusterfuzz-testcase-minimized-5693801463021568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/h264_cavlc.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/libavcodec/h264_cavlc.c b/libavcodec/h264_cavlc.c index c5d81031be..e70bb3e607 100644 --- a/libavcodec/h264_cavlc.c +++ b/libavcodec/h264_cavlc.c @@ -260,7 +260,7 @@ static VLC chroma422_dc_total_zeros_vlc[7+1]; static VLC_TYPE chroma422_dc_total_zeros_vlc_tables[7][32][2]; static const int chroma422_dc_total_zeros_vlc_tables_size = 32; -static VLC run_vlc[6]; +static VLC run_vlc[6+1]; static VLC_TYPE run_vlc_tables[6][8][2]; static const int run_vlc_tables_size = 8; @@ -394,9 +394,9 @@ av_cold void ff_h264_decode_init_vlc(void){ } for(i=0; i<6; i++){ - run_vlc[i].table = run_vlc_tables[i]; - run_vlc[i].table_allocated = run_vlc_tables_size; - init_vlc(&run_vlc[i], + run_vlc[i+1].table = run_vlc_tables[i]; + run_vlc[i+1].table_allocated = run_vlc_tables_size; + init_vlc(&run_vlc[i+1], RUN_VLC_BITS, 7, &run_len [i][0], 1, 1, &run_bits[i][0], 1, 1, @@ -586,7 +586,7 @@ static int decode_residual(const H264Context *h, H264SliceContext *sl, ((type*)block)[*scantable] = level[0]; \ for(i=1;i<total_coeff && zeros_left > 0;i++) { \ if(zeros_left < 7) \ - run_before= get_vlc2(gb, (run_vlc-1)[zeros_left].table, RUN_VLC_BITS, 1); \ + run_before= get_vlc2(gb, run_vlc[zeros_left].table, RUN_VLC_BITS, 1); \ else \ run_before= get_vlc2(gb, run7_vlc.table, RUN7_VLC_BITS, 2); \ zeros_left -= run_before; \ @@ -601,7 +601,7 @@ static int decode_residual(const H264Context *h, H264SliceContext *sl, ((type*)block)[*scantable] = ((int)(level[0] * qmul[*scantable] + 32))>>6; \ for(i=1;i<total_coeff && zeros_left > 0;i++) { \ if(zeros_left < 7) \ - run_before= get_vlc2(gb, (run_vlc-1)[zeros_left].table, RUN_VLC_BITS, 1); \ + run_before= get_vlc2(gb, run_vlc[zeros_left].table, RUN_VLC_BITS, 1); \ else \ run_before= get_vlc2(gb, run7_vlc.table, RUN7_VLC_BITS, 2); \ zeros_left -= run_before; \ |