@@ -455,10 +455,12 @@ static int lag_decode_arith_plane(LagarithContext *l, uint8_t *dst,
return -1;
ff_lag_rac_init(&rac, &gb, length - stride);
-
- for (i = 0; i < height; i++)
+ for (i = 0; i < height; i++) {
+ if (rac.overread > MAX_OVERREAD)
+ return AVERROR_INVALIDDATA;
read += lag_decode_line(l, &rac, dst + (i * stride), width,
stride, esc_count);
+ }
if (read > length)
av_log(l->avctx, AV_LOG_WARNING,
@@ -46,6 +46,7 @@ void ff_lag_rac_init(lag_rac *l, GetBitContext *gb, int length)
l->range = 0x80;
l->low = *l->bytestream >> 1;
l->hash_shift = FFMAX(l->scale, 10) - 10;
+ l->overread = 0;
for (i = j = 0; i < 1024; i++) {
unsigned r = i << l->hash_shift;
@@ -47,6 +47,9 @@ typedef struct lag_rac {
const uint8_t *bytestream; /**< Current position in input bytestream. */
const uint8_t *bytestream_end; /**< End position of input bytestream. */
+ int overread;
+#define MAX_OVERREAD 4
+
uint32_t prob[258]; /**< Table of cumulative probability for each symbol. */
uint8_t range_hash[1024]; /**< Hash table mapping upper byte to approximate symbol. */
} lag_rac;
@@ -62,6 +65,8 @@ static inline void lag_rac_refill(lag_rac *l)
l->low |= 0xff & (AV_RB16(l->bytestream) >> 1);
if (l->bytestream < l->bytestream_end)
l->bytestream++;
+ else
+ l->overread++;
}
}
Fixes: timeout Fixes: 2933/clusterfuzz-testcase-5124990208835584 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/lagarith.c | 6 ++++-- libavcodec/lagarithrac.c | 1 + libavcodec/lagarithrac.h | 5 +++++ 3 files changed, 10 insertions(+), 2 deletions(-)