| Message ID | 20240401020006.12107-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 589fa8a027f3b1707d78d7c45335acc498a5e887 |
| Headers | show |
| Series | [FFmpeg-devel,1/3] avcodec/exr: Check for remaining bits in huf_unpack_enc_table() | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Mon, Apr 01, 2024 at 04:00:04AM +0200, Michael Niedermayer wrote: > Fixes: Timeout > Fixes: 67645/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6308760977997824 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/exr.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) will apply patches 1+2 [...]
diff --git a/libavcodec/exr.c b/libavcodec/exr.c index 0f1f683e7e7..09f2fca109c 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -335,7 +335,10 @@ static int huf_unpack_enc_table(GetByteContext *gb, return ret; for (; im <= iM; im++) { - uint64_t l = freq[im] = get_bits(&gbit, 6); + uint64_t l; + if (get_bits_left(&gbit) < 6) + return AVERROR_INVALIDDATA; + l = freq[im] = get_bits(&gbit, 6); if (l == LONG_ZEROCODE_RUN) { int zerun = get_bits(&gbit, 8) + SHORTEST_LONG_RUN;
Fixes: Timeout Fixes: 67645/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6308760977997824 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/exr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)