diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-11 18:39:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-14 00:21:49 +0200 |
| commit | 5d0e4c877f3b06d96e8f96d7373006cb1ed00153 (patch) | |
| tree | 0488a1f31ff86a5571ef24e4e0a54393965d7cb4 | |
| parent | 383fdec3b2568681c5ed905bcd6d3628308c8e4c (diff) | |
| download | ffmpeg-5d0e4c877f3b06d96e8f96d7373006cb1ed00153.tar.gz | |
avcodec/cllc: Check num_bits
Fixes: runtime error: shift exponent -2 is negative
Fixes: 1479/clusterfuzz-testcase-minimized-6638493360979968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2bfd0a97587d26c0c39413a6291ccc66e4a928d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/cllc.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavcodec/cllc.c b/libavcodec/cllc.c index bbd2e62c5c..ec11fc34b0 100644 --- a/libavcodec/cllc.c +++ b/libavcodec/cllc.c @@ -55,6 +55,13 @@ static int read_code_table(CLLCContext *ctx, GetBitContext *gb, VLC *vlc) num_lens = get_bits(gb, 5); + if (num_lens > VLC_BITS * VLC_DEPTH) { + vlc->table = NULL; + + av_log(ctx->avctx, AV_LOG_ERROR, "To long VLCs %d\n", num_lens); + return AVERROR_INVALIDDATA; + } + for (i = 0; i < num_lens; i++) { num_codes = get_bits(gb, 9); num_codes_sum += num_codes; |