diff mbox

[FFmpeg-devel,2/2] avcodec/diracdec: check that GetBitContext has not ended in codeblock()

Message ID 20180913235156.9551-2-michael@niedermayer.cc
State Accepted
Commit 179ed2d2e08949662de2249c71f01ae388ca851e
Headers show

Commit Message

Michael Niedermayer Sept. 13, 2018, 11:51 p.m. UTC 
Fixes: Timeout (part 2 of 2)
Fixes: 9774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5748957085958144

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/diracdec.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Michael Niedermayer Sept. 28, 2018, 12:15 a.m. UTC | #1 
On Fri, Sep 14, 2018 at 01:51:56AM +0200, Michael Niedermayer wrote:
> Fixes: Timeout (part 2 of 2)
> Fixes: 9774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5748957085958144
> 
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/diracdec.c | 2 ++
>  1 file changed, 2 insertions(+)

will apply

[...]
diff mbox

Patch

diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index cbd7fd1532..af561d1426 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -548,6 +548,8 @@  static inline int codeblock(DiracContext *s, SubBand *b,
         }
     } else {
         for (y = top; y < bottom; y++) {
+            if (get_bits_left(gb) < 1)
+                return AVERROR_INVALIDDATA;
             for (x = left; x < right; x++) {
                 int val = coeff_unpack_golomb(gb, qfactor, qoffset);
                 if (b->pshift) {