diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-12 02:17:18 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-11-15 12:25:45 +0100 |
| commit | 32b4512aeca862815363a99ea1e84b87205d4053 (patch) | |
| tree | 8a506f6cc4963a57f9ec14da06b16f1e86107a6d | |
| parent | 1adb5720a2a5bd0ecc74e9df319ce5f019a42fca (diff) | |
| download | ffmpeg-32b4512aeca862815363a99ea1e84b87205d4053.tar.gz | |
avcodec/4xm: Check for end of input in decode_p_block()
Fixes: Timeout (81sec -> 0.2sec)
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f92eb05e063e6c4d6e36521020620d4e6e1c21d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/4xm.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index 7e6a15e49f..5cfb9e735e 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -351,6 +351,8 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, const uint16_t *src, index = size2index[log2h][log2w]; av_assert0(index >= 0); + if (get_bits_left(&f->gb) < 1) + return AVERROR_INVALIDDATA; h = 1 << log2h; code = get_vlc2(&f->gb, block_type_vlc[1 - (f->version > 1)][index].table, BLOCK_TYPE_VLC_BITS, 1); |