diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-12 02:17:18 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-13 16:48:38 +0200 |
| commit | 8f92eb05e063e6c4d6e36521020620d4e6e1c21d (patch) | |
| tree | 37ae5c8398433b5729bec98ceb251b4c70cefd74 | |
| parent | 021f29506b493376d62cdb5b9cb66a6b85e5361f (diff) | |
| download | ffmpeg-8f92eb05e063e6c4d6e36521020620d4e6e1c21d.tar.gz | |
avcodec/4xm: Check for end of input in decode_p_block()
Fixes: Timeout (81sec -> 0.2sec)
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/4xm.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index 8382159bde..1f4e2aee24 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -351,6 +351,8 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, const uint16_t *src, index = size2index[log2h][log2w]; av_assert0(index >= 0); + if (get_bits_left(&f->gb) < 1) + return AVERROR_INVALIDDATA; h = 1 << log2h; code = get_vlc2(&f->gb, block_type_vlc[1 - (f->version > 1)][index].table, BLOCK_TYPE_VLC_BITS, 1); |