diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-11-22 00:31:47 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-10-09 22:02:20 +0200 |
| commit | 5ef9f6e6e3d491b82da2acb56a0d0cd7e65d73d0 (patch) | |
| tree | 02f83b97c37f9301e4620cf4a22ad948af289b2c | |
| parent | 00cc2e7df2a60f9166eae13766ba1ab729232d3e (diff) | |
| download | ffmpeg-5ef9f6e6e3d491b82da2acb56a0d0cd7e65d73d0.tar.gz | |
avcodec/rscc: Check inflated_buf size whan it is used
Fixes: out of array access
Fixes: 27434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5196757675540480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit a5ed6da9bdbe32408aabe1c75e4b55fcaeec1e9b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/rscc.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c index c744349693..2d867df661 100644 --- a/libavcodec/rscc.c +++ b/libavcodec/rscc.c @@ -282,6 +282,10 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data, ret = AVERROR_INVALIDDATA; goto end; } + if (ctx->inflated_size < pixel_size) { + ret = AVERROR_INVALIDDATA; + goto end; + } ret = uncompress(ctx->inflated_buf, &len, gbc->buffer, packed_size); if (ret) { av_log(avctx, AV_LOG_ERROR, "Pixel deflate error %d.\n", ret); |