Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes:
15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/vc1_block.c | 34 ++
1 file changed, 26 insertions(+), 8 deletions(-)
diff --git a/libavcodec/vc1_block.c b/libavcodec/vc1_block.c
index 86320db959..ec5339d2f0 100644
--- a/libavcodec/vc1_block.c
+++ b/libavcodec/vc1_block.c
@@ -508,13 +508,15 @@ static inline int vc1_coded_block_pred(MpegEncContext *
s, int n,
* @param codingset set of VLC to decode data
* @see 8.1.3.4
*/
-static void vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip,
+static int vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip,
int *value, int codingset)
{
GetBitContext *gb = >s.gb;
int index, run, level, lst, sign;
index = get_vlc2(gb, ff_vc1_ac_coeff_table[codingset].table, AC_VLC_BITS,
3);
+if (index < 0)
+return index;
if (index != ff_vc1_ac_sizes[codingset] - 1) {
run = vc1_index_decode_table[codingset][index][0];
level = vc1_index_decode_table[codingset][index][1];
@@ -560,6 +562,8 @@ static void vc1_decode_ac_coeff(VC1Context *v, int *last,
int *skip,
*last = lst;
*skip = run;
*value = (level ^ -sign) + sign;
+
+return 0;
}
/** Decode intra block in intra frames - should be faster than
decode_intra_block
@@ -639,7 +643,9 @@ static int vc1_decode_i_block(VC1Context *v, int16_t
block[64], int n,
zz_table = v->zz_8x8[1];
while (!last) {
-vc1_decode_ac_coeff(v, , , , codingset);
+int ret = vc1_decode_ac_coeff(v, , , , codingset);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -812,7 +818,9 @@ static int vc1_decode_i_block_adv(VC1Context *v, int16_t
block[64], int n,
}
while (!last) {
-vc1_decode_ac_coeff(v, , , , codingset);
+int ret = vc1_decode_ac_coeff(v, , , , codingset);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -995,7 +1003,9 @@ static int vc1_decode_intra_block(VC1Context *v, int16_t
block[64], int n,
int k;
while (!last) {
-vc1_decode_ac_coeff(v, , , , codingset);
+int ret = vc1_decode_ac_coeff(v, , , , codingset);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -1161,7 +1171,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
last = 0;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -1189,7 +1201,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
off = (j & 1) * 4 + (j & 2) * 16;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 15)
break;
@@ -1216,7 +1230,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
off = j * 32;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 31)
break;
@@ -1243,7 +1259,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
off = j * 4;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 31)
break;
--
2.21.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
