diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-03-17 22:19:33 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-03-26 16:00:14 +0100 |
| commit | e8bd34fe4fc05700b19c3915ff9768c8072309c4 (patch) | |
| tree | 42646c6dc56ff1530672a3634b80fa65822e7281 | |
| parent | f44068db1e12f14e567e46844447aaa78c694b0b (diff) | |
| download | ffmpeg-e8bd34fe4fc05700b19c3915ff9768c8072309c4.tar.gz | |
avcodec/sga: Check for array end in lzss_decompress()
Fixes: out of array access
Fixes: 31640/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGA_fuzzer-5630883286614016
Fixes: 31619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGA_fuzzer-5176667708456960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/sga.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/sga.c b/libavcodec/sga.c index 00752a5843..7e6bea530c 100644 --- a/libavcodec/sga.c +++ b/libavcodec/sga.c @@ -232,7 +232,7 @@ static int lzss_decompress(AVCodecContext *avctx, if (offset <= 0) offset = 1; - if (oi < offset) + if (oi < offset || oi + count * 2 > dst_size) return AVERROR_INVALIDDATA; for (int j = 0; j < count * 2; j++) { dst[oi] = dst[oi - offset]; |