diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-14 20:31:39 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-10-06 13:59:34 +0200 |
| commit | 01b228834a4f33c3054e6a3c06484fb4dd35770f (patch) | |
| tree | 8671e12a5333240ee8e91adbdf0b0a38d3e364a2 /libavcodec | |
| parent | 8b8ab274af2c04f38a6674312687ec6d32aba2b9 (diff) | |
| download | ffmpeg-01b228834a4f33c3054e6a3c06484fb4dd35770f.tar.gz | |
avcodec/flicvideo: Check remaining bytes in FLI*COPY
Fixes: Timeout
Fixes: 37795/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4846536543043584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f835efbca874ad42cb954e6788588f52a57a7a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/flicvideo.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c index bf8ffeba4f..bf095f7461 100644 --- a/libavcodec/flicvideo.c +++ b/libavcodec/flicvideo.c @@ -735,6 +735,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, bytestream2_skip(&g2, chunk_size - 6); } else { + if (bytestream2_get_bytes_left(&g2) < 2 * s->avctx->width * s->avctx->height ) + return AVERROR_INVALIDDATA; for (y_ptr = 0; y_ptr < s->frame->linesize[0] * s->avctx->height; y_ptr += s->frame->linesize[0]) { |