diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-14 00:15:55 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-18 11:33:16 +0200 |
| commit | b9f92093a10217b14d923220aaa186f41a0cf555 (patch) | |
| tree | 0c737f75aa690726d6c4343f0c0d0944b8e67753 /libavcodec/ffv1dec_template.c | |
| parent | c359c51947c9ac925cc4a5d1893ef20ea1d3b4c8 (diff) | |
| download | ffmpeg-b9f92093a10217b14d923220aaa186f41a0cf555.tar.gz | |
avcodec/ffv1dec: Check for bitstream end in decode_line()
Fixes: timeout
Fixes: 2971/clusterfuzz-testcase-6130678276030464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/ffv1dec_template.c')
| -rw-r--r-- | libavcodec/ffv1dec_template.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/ffv1dec_template.c b/libavcodec/ffv1dec_template.c index d41d807e64..37df766773 100644 --- a/libavcodec/ffv1dec_template.c +++ b/libavcodec/ffv1dec_template.c @@ -20,7 +20,7 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ -static av_always_inline void RENAME(decode_line)(FFV1Context *s, int w, +static av_always_inline int RENAME(decode_line)(FFV1Context *s, int w, TYPE *sample[2], int plane_index, int bits) { @@ -31,6 +31,9 @@ static av_always_inline void RENAME(decode_line)(FFV1Context *s, int w, int run_mode = 0; int run_index = s->run_index; + if (is_input_end(s)) + return AVERROR_INVALIDDATA; + if (s->slice_coding_mode == 1) { int i; for (x = 0; x < w; x++) { @@ -41,7 +44,7 @@ static av_always_inline void RENAME(decode_line)(FFV1Context *s, int w, } sample[1][x] = v; } - return; + return 0; } for (x = 0; x < w; x++) { @@ -101,6 +104,7 @@ static av_always_inline void RENAME(decode_line)(FFV1Context *s, int w, sample[1][x] = av_mod_uintp2(RENAME(predict)(sample[1] + x, sample[0] + x) + (SUINT)diff, bits); } s->run_index = run_index; + return 0; } static void RENAME(decode_rgb_frame)(FFV1Context *s, uint8_t *src[3], int w, int h, int stride[3]) |