mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-01-24 13:56:33 +02:00
avcodec/iff: Check length before memcpy() in decode_deep_rle32()
Fixes: out of array read Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit b4a33387cb1cd3f4c5036e65e0fdd953c6b5012f) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
e038ecf707
commit
2f1bf34522
@ -722,6 +722,8 @@ static void decode_deep_rle32(uint8_t *dst, const uint8_t *src, int src_size, in
|
||||
int size = opcode + 1;
|
||||
for (i = 0; i < size; i++) {
|
||||
int length = FFMIN(size - i, width);
|
||||
if (src_end - src < length * 4)
|
||||
return;
|
||||
memcpy(dst + y*linesize + x * 4, src, length * 4);
|
||||
src += length * 4;
|
||||
x += length;
|
||||
|
Loading…
x
Reference in New Issue
Block a user