You've already forked FFmpeg
mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-07-11 14:30:22 +02:00
rv30: check block type validity
Prevents crashes with the fuzzed samples from bugs 88, 89 and 125 after "golomb: avoid infinite loop on all-zero input".
This commit is contained in:
@ -103,7 +103,7 @@ static int rv30_decode_mb_info(RV34DecContext *r)
|
||||
GetBitContext *gb = &s->gb;
|
||||
int code = svq3_get_ue_golomb(gb);
|
||||
|
||||
if(code > 11){
|
||||
if (code < 0 || code > 11) {
|
||||
av_log(s->avctx, AV_LOG_ERROR, "Incorrect MB type code\n");
|
||||
return -1;
|
||||
}
|
||||
|
Reference in New Issue
Block a user