diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-06-18 15:48:23 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-06-26 20:49:34 +0200 |
| commit | 3a9292aff320d7b5048b371b1babea2f9b3c4e69 (patch) | |
| tree | f6e0be30ab23d7812fe38ebc02f5edc116c5611e | |
| parent | eb9c96a82f95ec621dbaa7477fd74573c95e07cd (diff) | |
| download | ffmpeg-3a9292aff320d7b5048b371b1babea2f9b3c4e69.tar.gz | |
avcodec/snowenc: MV limits due to mv_penalty table size
Fixes: out of array read
Fixes: 69673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5476592894148608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/snowenc.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/snowenc.c b/libavcodec/snowenc.c index 9db4314efb..0b87d751b8 100644 --- a/libavcodec/snowenc.c +++ b/libavcodec/snowenc.c @@ -411,6 +411,7 @@ static int encode_q_branch(SnowEncContext *enc, int level, int x, int y) int my_context= av_log2(2*FFABS(left->my - top->my)); int s_context= 2*left->level + 2*top->level + tl->level + tr->level; int ref, best_ref, ref_score, ref_mx, ref_my; + int range = MAX_MV >> (1 + qpel); av_assert0(sizeof(s->block_state) >= 256); if(s->keyframe){ @@ -452,6 +453,11 @@ static int encode_q_branch(SnowEncContext *enc, int level, int x, int y) c->xmax = - (x+1)*block_w + (w<<(LOG2_MB_SIZE - s->block_max_depth)) + 16-3; c->ymax = - (y+1)*block_w + (h<<(LOG2_MB_SIZE - s->block_max_depth)) + 16-3; + c->xmin = FFMAX(c->xmin,-range); + c->xmax = FFMIN(c->xmax, range); + c->ymin = FFMAX(c->ymin,-range); + c->ymax = FFMIN(c->ymax, range); + if(P_LEFT[0] > (c->xmax<<shift)) P_LEFT[0] = (c->xmax<<shift); if(P_LEFT[1] > (c->ymax<<shift)) P_LEFT[1] = (c->ymax<<shift); if(P_TOP[0] > (c->xmax<<shift)) P_TOP[0] = (c->xmax<<shift); |