har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/bgmc: Check input space in ff_bgmc_decode_init()

Browse Source 
Fixes: Infinite loop
Fixes: 16608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5636229827133440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-09-01 22:31:45 +02:00
parent daf92cc074
commit b54031a6e9
3 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/alsdec.c
View File

@ -821,7 +821,9 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
unsigned int low;
unsigned int value;
ff_bgmc_decode_init(gb, &high, &low, &value);
int ret = ff_bgmc_decode_init(gb, &high, &low, &value);
if (ret < 0)
return ret;
current_res = bd->raw_samples + start;

7
libavcodec/bgmc.c
View File

@ -485,12 +485,17 @@ av_cold void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status)
/** Initialize decoding and reads the first value */
void ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
int ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
unsigned int *l, unsigned int *v)
{
if (get_bits_left(gb) < VALUE_BITS)
return AVERROR_INVALIDDATA;
*h = TOP_VALUE;
*l = 0;
*v = get_bits_long(gb, VALUE_BITS);
return 0;
}

2
libavcodec/bgmc.h
View File

@ -40,7 +40,7 @@ int ff_bgmc_init(AVCodecContext *avctx, uint8_t **cf_lut, int **cf_lut_status);
void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status);
void ff_bgmc_decode_init(GetBitContext *gb,
int ff_bgmc_decode_init(GetBitContext *gb,
unsigned int *h, unsigned int *l, unsigned int *v);