Message ID | 20190908213419.22293-3-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | 3dce4d03d5a555bff2e11f97fb54701b22effeaf |
Headers | show |
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index 98b6e58be3..d17852d8ba 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -409,6 +409,8 @@ static int read_stream_mux_config(struct LATMContext *latmctx, } else { int esc; do { + if (get_bits_left(gb) < 9) + return AVERROR_INVALIDDATA; esc = get_bits(gb, 1); skip_bits(gb, 8); } while (esc);
Fixes: Infinite loop Fixes: 16920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5653421289373696 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/aacdec.c | 2 ++ 1 file changed, 2 insertions(+)