aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2018-08-20 22:53:32 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2018-10-28 02:22:42 +0200
commitb61b38766ee9ebf31f69bea834fa23bb63dcb8b8 (patch)
tree4f1aea80b9be3e8910241c58d19335ce7d048ea2
parent88afcff2f5530ec08f2e559987d73945da640aea (diff)
downloadffmpeg-b61b38766ee9ebf31f69bea834fa23bb63dcb8b8.tar.gz
avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()
Fixes: Timeout Fixes: 9634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-6267852259590144 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c9222b972d6cbdaf6571cf7ae0a6513bffa5ff9f) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/hq_hqa.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/hq_hqa.c b/libavcodec/hq_hqa.c
index f88ad7d5f5..ec9da3e04f 100644
--- a/libavcodec/hq_hqa.c
+++ b/libavcodec/hq_hqa.c
@@ -181,6 +181,9 @@ static int hqa_decode_mb(HQContext *c, AVFrame *pic, int qgroup,
int flag = 0;
int i, ret, cbp;
+ if (get_bits_left(gb) < 1)
+ return AVERROR_INVALIDDATA;
+
cbp = get_vlc2(gb, c->hqa_cbp_vlc.table, 5, 1);
for (i = 0; i < 12; i++)