aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/alsdec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2022-10-29 18:47:34 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2022-11-04 22:47:19 +0100
commit1dc8d82da910972d308aebc1ee722044f83b9ccc (patch)
treeb25e010b5b04733a61d51b42bcec66eb52526b92 /libavcodec/alsdec.c
parent5280947fb6db37063334eae5b467cecd2417b063 (diff)
downloadffmpeg-1dc8d82da910972d308aebc1ee722044f83b9ccc.tar.gz
avcodec/alsdec: Check bits left before block decoding in non multi channel coding loop
Fixes: Timeout Fixes: 52161/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-6440216563154944 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Diffstat (limited to 'libavcodec/alsdec.c')
-rw-r--r--libavcodec/alsdec.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index eab382e74f..4605b2248f 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -1660,7 +1660,8 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame)
if (!sconf->mc_coding || ctx->js_switch) {
int independent_bs = !sconf->joint_stereo;
-
+ if (get_bits_left(gb) < 7*channels*ctx->num_blocks)
+ return AVERROR_INVALIDDATA;
for (c = 0; c < channels; c++) {
js_blocks[0] = 0;
js_blocks[1] = 0;