virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-19 05:49:09 +02:00
Code Issues Releases Activity

avcodec/flicvideo: Check frame_size before decrementing

Browse Source 
Fixes: runtime error: signed integer overflow: -2147483627 - 22 cannot be represented in type 'int'
Fixes: 1637/clusterfuzz-testcase-minimized-5376582493405184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 355e27e24dc88d6ba8f27501a34925d9d937a399)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-17 01:12:55 +02:00
parent f5d0960872
commit 209124a944
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/flicvideo.c
View File

@ -202,6 +202,9 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
num_chunks = bytestream2_get_le16(&g2);
bytestream2_skip(&g2, 8); /* skip padding */
if (frame_size < 16)
return AVERROR_INVALIDDATA;
frame_size -= 16;
/* iterate through the chunks */
@ -520,6 +523,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
if (frame_size > buf_size)
frame_size = buf_size;
if (frame_size < 16)
return AVERROR_INVALIDDATA;
frame_size -= 16;
/* iterate through the chunks */