diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2025-08-03 14:52:36 +0200 |
|---|---|---|
| committer | michaelni <michael@niedermayer.cc> | 2025-08-03 13:19:25 +0000 |
| commit | 44864dbbb9b87d13d8f4ec92fb8536be0f9dbbc4 (patch) | |
| tree | c540b92137f0f76cef52f0662248e91a40f84c38 | |
| parent | 7e9e7cb3b65167f37dcbfcf6a2ee308548af4e73 (diff) | |
| download | ffmpeg-44864dbbb9b87d13d8f4ec92fb8536be0f9dbbc4.tar.gz | |
avcodec/vqavideo; Check bytestream2_get_buffer() reading next_codebook_buffer
Fixes: use of uninintilaized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6235973619351552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/vqavideo.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/libavcodec/vqavideo.c b/libavcodec/vqavideo.c index b81d13ea67..99c86a4610 100644 --- a/libavcodec/vqavideo.c +++ b/libavcodec/vqavideo.c @@ -571,8 +571,9 @@ static int vqa_decode_frame_pal8(VqaContext *s, AVFrame *frame) } /* accumulate partial codebook */ - bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index], - chunk_size); + if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index], + chunk_size)) + return AVERROR_INVALIDDATA; s->next_codebook_buffer_index += chunk_size; s->partial_countdown--; @@ -600,8 +601,9 @@ static int vqa_decode_frame_pal8(VqaContext *s, AVFrame *frame) } /* accumulate partial codebook */ - bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index], - chunk_size); + if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index], + chunk_size)) + return AVERROR_INVALIDDATA; s->next_codebook_buffer_index += chunk_size; s->partial_countdown--; |