aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2020-04-21 00:03:40 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2020-07-01 13:33:44 +0200
commitc12d62bf777db53e4af7657cc46ac6cfc63f1875 (patch)
tree99550f29a9b6f2f489fcbd645213b67eea352411 /libavcodec
parent101f32f843bf108c6d37d8854568927f6082245c (diff)
downloadffmpeg-c12d62bf777db53e4af7657cc46ac6cfc63f1875.tar.gz
avcodec/iff: Check length before memcpy() in decode_deep_rle32()
Fixes: out of array read Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit b4a33387cb1cd3f4c5036e65e0fdd953c6b5012f) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/iff.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index 76ad63d102..83d0ee524d 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -722,6 +722,8 @@ static void decode_deep_rle32(uint8_t *dst, const uint8_t *src, int src_size, in
int size = opcode + 1;
for (i = 0; i < size; i++) {
int length = FFMIN(size - i, width);
+ if (src_end - src < length * 4)
+ return;
memcpy(dst + y*linesize + x * 4, src, length * 4);
src += length * 4;
x += length;