Commit 95b9ac04 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/mv30: check mode_size vs. input space

Fixes: Timeout (longer than my patience vs 1sec)
Fixes: 22984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5630021988515840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75e2ac4f0752649a0b9486e6825ef68341ee974d)
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent f8239323
...@@ -410,6 +410,9 @@ static int decode_intra(AVCodecContext *avctx, GetBitContext *gb, AVFrame *frame ...@@ -410,6 +410,9 @@ static int decode_intra(AVCodecContext *avctx, GetBitContext *gb, AVFrame *frame
int ret; int ret;
mgb = *gb; mgb = *gb;
if (get_bits_left(gb) < s->mode_size * 8)
return AVERROR_INVALIDDATA;
skip_bits_long(gb, s->mode_size * 8); skip_bits_long(gb, s->mode_size * 8);
linesize[0] = frame->linesize[0]; linesize[0] = frame->linesize[0];
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment