diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-02-25 13:26:25 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-03-03 13:17:02 +0100 |
| commit | 951bb7632fe6e3bb1a9c3b47610705871e471f34 (patch) | |
| tree | 0f94c5ff57899d47fa776dfc57950b62ebcdd6cb /libavcodec/aic.c | |
| parent | 5cf42f65b60d226d1223d2100cb1d90402189275 (diff) | |
| download | ffmpeg-951bb7632fe6e3bb1a9c3b47610705871e471f34.tar.gz | |
avcodec/aic: Check remaining bits in aic_decode_coeffs()
Fixes: Timeout (78 seconds -> 2 seconds)
Fixes: 13186/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5639516533030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/aic.c')
| -rw-r--r-- | libavcodec/aic.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/aic.c b/libavcodec/aic.c index 9c6f806655..dc28c83661 100644 --- a/libavcodec/aic.c +++ b/libavcodec/aic.c @@ -208,6 +208,9 @@ static int aic_decode_coeffs(GetBitContext *gb, int16_t *dst, int mb, idx; unsigned val; + if (get_bits_left(gb) < 5) + return AVERROR_INVALIDDATA; + has_skips = get_bits1(gb); coeff_type = get_bits1(gb); coeff_bits = get_bits(gb, 3); |