diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-04-01 02:15:07 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-04-03 00:44:38 +0200 |
| commit | 589fa8a027f3b1707d78d7c45335acc498a5e887 (patch) | |
| tree | 44582f060b1f71f5b492a9ef2b1d55780ded2d32 /libavcodec | |
| parent | 1887ff250cfd1e69c08bca21cc53e30a39e26818 (diff) | |
| download | ffmpeg-589fa8a027f3b1707d78d7c45335acc498a5e887.tar.gz | |
avcodec/exr: Check for remaining bits in huf_unpack_enc_table()
Fixes: Timeout
Fixes: 67645/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6308760977997824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/exr.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/exr.c b/libavcodec/exr.c index 0f1f683e7e..09f2fca109 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -335,7 +335,10 @@ static int huf_unpack_enc_table(GetByteContext *gb, return ret; for (; im <= iM; im++) { - uint64_t l = freq[im] = get_bits(&gbit, 6); + uint64_t l; + if (get_bits_left(&gbit) < 6) + return AVERROR_INVALIDDATA; + l = freq[im] = get_bits(&gbit, 6); if (l == LONG_ZEROCODE_RUN) { int zerun = get_bits(&gbit, 8) + SHORTEST_LONG_RUN; |