virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avcodec/vqavideo; Check bytestream2_get_buffer() reading next_codebook_buffer

Browse Source 
Fixes: use of uninintilaized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6235973619351552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-08-03 14:52:36 +02:00
committed by michaelni
parent 7e9e7cb3b6
commit 44864dbbb9
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/vqavideo.c
View File

@ -571,8 +571,9 @@ static int vqa_decode_frame_pal8(VqaContext *s, AVFrame *frame)
}
/* accumulate partial codebook */
bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
chunk_size);
if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
chunk_size))
return AVERROR_INVALIDDATA;
s->next_codebook_buffer_index += chunk_size;
s->partial_countdown--;
@ -600,8 +601,9 @@ static int vqa_decode_frame_pal8(VqaContext *s, AVFrame *frame)
}
/* accumulate partial codebook */
bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
chunk_size);
if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
chunk_size))
return AVERROR_INVALIDDATA;
s->next_codebook_buffer_index += chunk_size;
s->partial_countdown--;