diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-08-19 20:37:56 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-08-28 16:27:55 +0200 |
| commit | b9c7f50c7de9b7d8c533eae173c9b77a6719346c (patch) | |
| tree | 10193077b6d1bfe867ac06123e671d06bc2ae3e8 | |
| parent | 01910ca6037379804572c5ec9bbd0b94e7e4b83e (diff) | |
| download | ffmpeg-b9c7f50c7de9b7d8c533eae173c9b77a6719346c.tar.gz | |
avcodec/notchlc: Check bytes left before reading
Fixes: Use of uninitialized value
Fixes: 71230/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-4624502095413248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/notchlc.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/notchlc.c b/libavcodec/notchlc.c index 371c8b5e54..246a3e0174 100644 --- a/libavcodec/notchlc.c +++ b/libavcodec/notchlc.c @@ -93,6 +93,9 @@ static int lz4_decompress(AVCodecContext *avctx, } while (current == 255); } + if (bytestream2_get_bytes_left(gb) < num_literals) + return AVERROR_INVALIDDATA; + if (pos + num_literals < HISTORY_SIZE) { bytestream2_get_buffer(gb, history + pos, num_literals); pos += num_literals; |