aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2020-11-22 00:31:47 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2021-09-09 13:53:29 +0200
commit95ffb56c6c75ef7958d7e70a5df493d13452ed95 (patch)
tree22b94b01373e2bf1e517ac40dbd18771721e5511 /libavcodec
parent26e5301458ea47f9ed7bba20f86bef08a6aab832 (diff)
downloadffmpeg-95ffb56c6c75ef7958d7e70a5df493d13452ed95.tar.gz
avcodec/rscc: Check inflated_buf size whan it is used
Fixes: out of array access Fixes: 27434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5196757675540480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg (cherry picked from commit a5ed6da9bdbe32408aabe1c75e4b55fcaeec1e9b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/rscc.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c
index 69cb702777..99544762d9 100644
--- a/libavcodec/rscc.c
+++ b/libavcodec/rscc.c
@@ -299,6 +299,10 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data,
ret = AVERROR_INVALIDDATA;
goto end;
}
+ if (ctx->inflated_size < pixel_size) {
+ ret = AVERROR_INVALIDDATA;
+ goto end;
+ }
ret = uncompress(ctx->inflated_buf, &len, gbc->buffer, packed_size);
if (ret) {
av_log(avctx, AV_LOG_ERROR, "Pixel deflate error %d.\n", ret);