diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-02-25 13:26:25 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-03-24 10:38:51 +0100 |
| commit | 7cc9a207919f4ddda55501d2a05fc410ec6c04f8 (patch) | |
| tree | 6c8700d9b25235a7d6154a712ef085c6f092848f /libavcodec | |
| parent | 98fa61c020722f7251435f3377eba449127962d8 (diff) | |
| download | ffmpeg-7cc9a207919f4ddda55501d2a05fc410ec6c04f8.tar.gz | |
avcodec/aic: Check remaining bits in aic_decode_coeffs()
Fixes: Timeout (78 seconds -> 2 seconds)
Fixes: 13186/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5639516533030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 951bb7632fe6e3bb1a9c3b47610705871e471f34)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/aic.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/aic.c b/libavcodec/aic.c index 67d78c5ddd..77f342e6d6 100644 --- a/libavcodec/aic.c +++ b/libavcodec/aic.c @@ -208,6 +208,9 @@ static int aic_decode_coeffs(GetBitContext *gb, int16_t *dst, int mb, idx; unsigned val; + if (get_bits_left(gb) < 5) + return AVERROR_INVALIDDATA; + has_skips = get_bits1(gb); coeff_type = get_bits1(gb); coeff_bits = get_bits(gb, 3); |