avcodec/lscrdec: Check length in decode_idat()
Fixes: out of array access Fixes: 32264/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LSCR_fuzzer-6684504010915840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
		
							parent
							
								
									6055b93379
								
							
						
					
					
						commit
						c01cd2a8b2
					
				| @ -76,6 +76,10 @@ static int decode_idat(LSCRContext *s, int length) | ||||
|     int ret; | ||||
|     s->zstream.avail_in = FFMIN(length, bytestream2_get_bytes_left(&s->gb)); | ||||
|     s->zstream.next_in  = s->gb.buffer; | ||||
| 
 | ||||
|     if (length <= 0) | ||||
|         return AVERROR_INVALIDDATA; | ||||
| 
 | ||||
|     bytestream2_skip(&s->gb, length); | ||||
| 
 | ||||
|     /* decode one line if possible */ | ||||
|  | ||||
		Loading…
	
	
			
			x
			
			
		
	
		Reference in New Issue
	
	Block a user