diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-15 17:13:34 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-20 14:21:24 +0100 |
| commit | c4ae8618f46e1c2909ae2f88ab5ef7995278cf75 (patch) | |
| tree | 0275702c9c4eaa30341e704b98b5300f073eb920 | |
| parent | 2d155dcb7eae50a448c71af9c2324eafd47a98f5 (diff) | |
| download | ffmpeg-c4ae8618f46e1c2909ae2f88ab5ef7995278cf75.tar.gz | |
avcodec/vp8: Move end check into MB loop in vp78_decode_mv_mb_modes()
Fixes: Timeout (long -> 5sec)
Fixes: 30269/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP7_fuzzer-5430325004075008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a797ceafe2a96aa1682a1eca421eddd4c498275)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/vp8.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index bab4223aca..e84fcdeaa1 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -2289,10 +2289,10 @@ int vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe, s->mv_bounds.mv_min.x = -MARGIN; s->mv_bounds.mv_max.x = ((s->mb_width - 1) << 6) + MARGIN; - if (vpX_rac_is_end(&s->c)) { - return AVERROR_INVALIDDATA; - } for (mb_x = 0; mb_x < s->mb_width; mb_x++, mb_xy++, mb++) { + if (vpX_rac_is_end(&s->c)) { + return AVERROR_INVALIDDATA; + } if (mb_y == 0) AV_WN32A((mb - s->mb_width - 1)->intra4x4_pred_mode_top, DC_PRED * 0x01010101); |