Commit b2785cd3 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/hcom: Check that there are dictionary entries

Fixes: out of array read
Fixes: 17617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCOM_fuzzer-5674970478280704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: 's avatarPaul B Mahol <onemda@gmail.com>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent cfa19377
......@@ -52,7 +52,8 @@ static av_cold int hcom_init(AVCodecContext *avctx)
if (avctx->extradata_size <= 7)
return AVERROR_INVALIDDATA;
s->dict_entries = AV_RB16(avctx->extradata);
if (avctx->extradata_size < s->dict_entries * 4 + 7)
if (avctx->extradata_size < s->dict_entries * 4 + 7 ||
s->dict_entries == 0)
return AVERROR_INVALIDDATA;
s->delta_compression = AV_RB32(avctx->extradata + 2);
s->sample = s->first_sample = avctx->extradata[avctx->extradata_size - 1];
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment