virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avcodec/ffv1dec: Check k in get_vlc_symbol()

Browse Source 
The true problem happens in several previous get_vlc_symbol()
but checking that is more expensive (involving FFABS())
here its just a simple check between 2 variables we have.

Fixes: Assertion log >= k failed at libavcodec/golomb.h:406
Fixes: 429296194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_DEC_fuzzer-4691594622337024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-07-16 00:01:07 +02:00
parent c0f1c3e185
commit 051e0d7744
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/ffv1dec.c
View File

@ -56,6 +56,11 @@ static inline int get_vlc_symbol(GetBitContext *gb, VlcState *const state,
k++; k++;
i += i; i += i;
} }
if (k > bits) {
ff_dlog(NULL, "k-overflow bias:%d error:%d drift:%d count:%d k:%d",
state->bias, state->error_sum, state->drift, state->count, k);
k = bits;
}
v = get_sr_golomb(gb, k, 12, bits); v = get_sr_golomb(gb, k, 12, bits);
ff_dlog(NULL, "v:%d bias:%d error:%d drift:%d count:%d k:%d", ff_dlog(NULL, "v:%d bias:%d error:%d drift:%d count:%d k:%d",