diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-08 01:46:26 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-08 02:47:47 +0100 |
| commit | 3ab1311aba74a28cebfc22985cd9250fda93e6cf (patch) | |
| tree | 085472ed5d066df1963901052e2f98d08d20834a /libavcodec/golomb.h | |
| parent | 445204cd5777e029a6674ed0739777817eda5646 (diff) | |
| download | ffmpeg-3ab1311aba74a28cebfc22985cd9250fda93e6cf.tar.gz | |
avcodec/golomb: Consume invalid data in get_ur_golomb_jpegls()
Fixes slow loops on fuzzed data
Fixes: 245/fuzz-3-ffmpeg_AUDIO_AV_CODEC_ID_FLAC_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/golomb.h')
| -rw-r--r-- | libavcodec/golomb.h | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h index 917ea54e14..d9db8310dc 100644 --- a/libavcodec/golomb.h +++ b/libavcodec/golomb.h @@ -325,8 +325,10 @@ static inline int get_ur_golomb_jpegls(GetBitContext *gb, int k, int limit, } else { int i; for (i = 0; i < limit && SHOW_UBITS(re, gb, 1) == 0; i++) { - if (gb->size_in_bits <= re_index) + if (gb->size_in_bits <= re_index) { + CLOSE_READER(re, gb); return -1; + } LAST_SKIP_BITS(re, gb, 1); UPDATE_CACHE(re, gb); } @@ -348,16 +350,17 @@ static inline int get_ur_golomb_jpegls(GetBitContext *gb, int k, int limit, buf = 0; } - CLOSE_READER(re, gb); - return buf + (i << k); + buf += (i << k); } else if (i == limit - 1) { buf = SHOW_UBITS(re, gb, esc_len); LAST_SKIP_BITS(re, gb, esc_len); - CLOSE_READER(re, gb); - return buf + 1; - } else - return -1; + buf ++; + } else { + buf = -1; + } + CLOSE_READER(re, gb); + return buf; } } |