Commit 5859b5b4 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/lagarith: Detect end of input in lag_decode_line() loop

Fixes: timeout
Fixes: 2933/clusterfuzz-testcase-5124990208835584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 0561bd2f
......@@ -455,10 +455,12 @@ static int lag_decode_arith_plane(LagarithContext *l, uint8_t *dst,
return -1;
ff_lag_rac_init(&rac, &gb, length - stride);
for (i = 0; i < height; i++)
for (i = 0; i < height; i++) {
if (rac.overread > MAX_OVERREAD)
return AVERROR_INVALIDDATA;
read += lag_decode_line(l, &rac, dst + (i * stride), width,
stride, esc_count);
}
if (read > length)
av_log(l->avctx, AV_LOG_WARNING,
......
......@@ -46,6 +46,7 @@ void ff_lag_rac_init(lag_rac *l, GetBitContext *gb, int length)
l->range = 0x80;
l->low = *l->bytestream >> 1;
l->hash_shift = FFMAX(l->scale, 10) - 10;
l->overread = 0;
for (i = j = 0; i < 1024; i++) {
unsigned r = i << l->hash_shift;
......
......@@ -47,6 +47,9 @@ typedef struct lag_rac {
const uint8_t *bytestream; /**< Current position in input bytestream. */
const uint8_t *bytestream_end; /**< End position of input bytestream. */
int overread;
#define MAX_OVERREAD 4
uint32_t prob[258]; /**< Table of cumulative probability for each symbol. */
uint8_t range_hash[1024]; /**< Hash table mapping upper byte to approximate symbol. */
} lag_rac;
......@@ -62,6 +65,8 @@ static inline void lag_rac_refill(lag_rac *l)
l->low |= 0xff & (AV_RB16(l->bytestream) >> 1);
if (l->bytestream < l->bytestream_end)
l->bytestream++;
else
l->overread++;
}
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment