virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-08 13:22:53 +02:00
Code Issues Releases Activity

avcodec/rv60dec: Check qp for intra

Browse Source 
The rv60_qp_to_idx table only supports qp up to 31 on intra

Fixes: global-buffer-overflow
Fixes: 377543818/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5160167345291264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-12-02 00:24:53 +01:00
parent 559d435fa3
commit 61cbcaf93f
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/rv60dec.c
View File

@ -1779,6 +1779,8 @@ static int decode_cu_r(RV60Context * s, AVFrame * frame, ThreadContext * thread,
ttype = cu.pu_type == PU_FULL ? TRANSFORM_8X8 : TRANSFORM_4X4;
is_intra = cu.cu_type == CU_INTRA;
if (is_intra && qp >= 32)
return AVERROR_INVALIDDATA;
cu_pos = ((xpos & 63) >> 3) + ((ypos & 63) >> 3) * 8;
switch (ttype) {