diff mbox series

[FFmpeg-devel,1/8] avcodec/cbs_sei_syntax_template: Check for non negativity before setting size_t bits_left

Message ID 20210201223116.11378-1-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/8] avcodec/cbs_sei_syntax_template: Check for non negativity before setting size_t bits_left | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Michael Niedermayer Feb. 1, 2021, 10:31 p.m. UTC 
Fixes: Timeout
Fixes: 29892/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-6310830956216320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/cbs_sei_syntax_template.c | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/libavcodec/cbs_sei_syntax_template.c b/libavcodec/cbs_sei_syntax_template.c
index 9114e61ff6..3b9bc942f5 100644
--- a/libavcodec/cbs_sei_syntax_template.c
+++ b/libavcodec/cbs_sei_syntax_template.c
@@ -178,6 +178,8 @@  static int FUNC(message)(CodedBitstreamContext *ctx, RWContext *rw,
             GetBitContext tmp = *rw;
             int trailing_bits, trailing_zero_bits;
 
+            if (8 * current->payload_size < bits_written)
+                return AVERROR_INVALIDDATA;
             bits_left = 8 * current->payload_size - bits_written;
             if (bits_left > 8)
                 skip_bits_long(&tmp, bits_left - 8);