On Sat, Nov 19, 2022 at 10:03:08AM +1100, Peter Ross wrote: > On Fri, Nov 18, 2022 at 10:09:18PM +0100, Michael Niedermayer wrote: > > Fixes: Timeout > > Fixes: > > 52695/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQC_fuzzer-4882310386548736 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > > --- > > libavcodec/vqcdec.c | 14 ++++++++++---- > > 1 file changed, 10 insertions(+), 4 deletions(-) > > > > diff --git a/libavcodec/vqcdec.c b/libavcodec/vqcdec.c > > index 5d1a03158c..18cd99462e 100644 > > --- a/libavcodec/vqcdec.c > > +++ b/libavcodec/vqcdec.c > > @@ -137,7 +137,7 @@ static void seed_codebooks(VqcContext * s, const int * > > seed) > > } > > } > > > > -static void decode_vectors(VqcContext * s, const uint8_t * buf, int size, > > int width, int height) > > +static int decode_vectors(VqcContext * s, const uint8_t * buf, int size, > > int width, int height) > > { > > GetBitContext gb; > > uint8_t * vectors = s->vectors; > > @@ -155,9 +155,11 @@ static void decode_vectors(VqcContext * s, const > > uint8_t * buf, int size, int wi > > *dst++ = get_bits(&gb, 8); > > > > while (show_bits(&gb, 2) != 2) { > > - > > if (dst >= vectors_end - 1) > > - return; > > + return 0; > > + > > + if (get_bits_left(&gb) < 4) > > + return AVERROR_INVALIDDATA; > > > > if (!show_bits(&gb, 4)) { > > *dst++ = 0; > > @@ -182,6 +184,8 @@ static void decode_vectors(VqcContext * s, const > > uint8_t * buf, int size, int wi > > skip_bits(&gb, 2); > > vectors += 32; > > } > > + > > + return 0; > > } > > > > static void load_coeffs(VqcContext * s, const uint8_t * v, int width, int > > coeff_width) > > @@ -392,7 +396,9 @@ static int vqc_decode_frame(AVCodecContext *avctx, > > AVFrame * rframe, > > avpriv_request_sample(avctx, "gamma=0x%x, contrast=0x%x\n", gamma, > > contrast); > > > > seed_codebooks(s, seed); > > - decode_vectors(s, buf + 7, avpkt->size - 7, avctx->width, > > avctx->height); > > + ret = decode_vectors(s, buf + 7, avpkt->size - 7, avctx->width, > > avctx->height); > > + if (ret < 0) > > + return ret; > > decode_frame(s, avctx->width, avctx->height); > > please apply
will apply thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Avoid a single point of failure, be that a person or equipment.
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
