Commit c9c95805 authored by Michael Niedermayer's avatar Michael Niedermayer

libavcodec/mvha: Check height before applying median predictor

Fixes: out of array read
Fixes: 20495/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MVHA_fuzzer-5711179129552896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: 's avatarPaul B Mahol <onemda@gmail.com>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent b0eec139
......@@ -256,12 +256,14 @@ static int decode_frame(AVCodecContext *avctx,
dst = frame->data[p] + (avctx->height - 1) * frame->linesize[p];
s->llviddsp.add_left_pred(dst, dst, width, 0);
dst -= stride;
lefttop = left = dst[0];
for (int y = 1; y < avctx->height; y++) {
s->llviddsp.add_median_pred(dst, dst + stride, dst, width, &left, &lefttop);
lefttop = left = dst[0];
if (avctx->height > 1) {
dst -= stride;
lefttop = left = dst[0];
for (int y = 1; y < avctx->height; y++) {
s->llviddsp.add_median_pred(dst, dst + stride, dst, width, &left, &lefttop);
lefttop = left = dst[0];
dst -= stride;
}
}
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment