diff options
author | Michael Niedermayer <michael@niedermayer.cc> | 2020-11-22 00:31:47 +0100 |
---|---|---|
committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-09 13:53:29 +0200 |
commit | 95ffb56c6c75ef7958d7e70a5df493d13452ed95 (patch) | |
tree | 22b94b01373e2bf1e517ac40dbd18771721e5511 /libavcodec | |
parent | 26e5301458ea47f9ed7bba20f86bef08a6aab832 (diff) | |
download | ffmpeg-95ffb56c6c75ef7958d7e70a5df493d13452ed95.tar.gz |
avcodec/rscc: Check inflated_buf size whan it is used
Fixes: out of array access
Fixes: 27434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5196757675540480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit a5ed6da9bdbe32408aabe1c75e4b55fcaeec1e9b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
-rw-r--r-- | libavcodec/rscc.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c index 69cb702777..99544762d9 100644 --- a/libavcodec/rscc.c +++ b/libavcodec/rscc.c @@ -299,6 +299,10 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data, ret = AVERROR_INVALIDDATA; goto end; } + if (ctx->inflated_size < pixel_size) { + ret = AVERROR_INVALIDDATA; + goto end; + } ret = uncompress(ctx->inflated_buf, &len, gbc->buffer, packed_size); if (ret) { av_log(avctx, AV_LOG_ERROR, "Pixel deflate error %d.\n", ret); |