ffmpeg | branch: master | Michael Niedermayer <mich...@niedermayer.cc> | Tue Jul 15 23:28:09 2025 +0200| [c0f1c3e18579c249cc729bc6033c034f6a6f7426] | committer: Michael Niedermayer
avcodec/ivi: Check luma/chroma mb_size Fixes: shift exponent -1 is negative Fixes: 429011224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5031059358285824 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c0f1c3e18579c249cc729bc6033c034f6a6f7426 --- libavcodec/ivi.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavcodec/ivi.c b/libavcodec/ivi.c index e7d8d10c3e..a38f382d5f 100644 --- a/libavcodec/ivi.c +++ b/libavcodec/ivi.c @@ -994,9 +994,11 @@ static int decode_band(IVI45DecContext *ctx, for (t = 0; t < band->num_tiles; t++) { tile = &band->tiles[t]; - if (tile->mb_size != band->mb_size) { - av_log(avctx, AV_LOG_ERROR, "MB sizes mismatch: %d vs. %d\n", - band->mb_size, tile->mb_size); + if (tile->mb_size != band->mb_size || + ctx->planes[0].bands[0].mb_size < band->mb_size + ) { + av_log(avctx, AV_LOG_ERROR, "MB sizes mismatch: %d vs. %d vs. %d\n", + band->mb_size, tile->mb_size, ctx->planes[0].bands[0].mb_size); return AVERROR_INVALIDDATA; } tile->is_empty = get_bits1(&ctx->gb); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
