mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-12-23 12:43:46 +02:00
avcodec/lzf: Consider the needed size in reallocation
Fixes: NULL pointer dereference Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
5bd5c31087
commit
292b9b93a5
@ -49,7 +49,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
|
||||
if (s < LZF_LITERAL_MAX) {
|
||||
s++;
|
||||
if (s > *size - len) {
|
||||
*size += *size /2;
|
||||
*size += s + *size /2;
|
||||
ret = av_reallocp(buf, *size);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
@ -72,7 +72,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
|
||||
return AVERROR_INVALIDDATA;
|
||||
|
||||
if (l > *size - len) {
|
||||
*size += *size / 2;
|
||||
*size += l + *size / 2;
|
||||
ret = av_reallocp(buf, *size);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
|
Loading…
Reference in New Issue
Block a user