From 67040773dc8c54f8df1a034cb33b1cb4117a8fd3 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 14 May 2025 00:15:41 +0200
Subject: [PATCH] avcodec/ffv1enc_template: Fix remaining space check

Fixes: Assertion sc->slice_coding_mode == 0 failed at libavcodec/ffv1enc.c:1667
Fixes: 408838118/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-6493138204295168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/ffv1enc_template.c | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/libavcodec/ffv1enc_template.c b/libavcodec/ffv1enc_template.c
index 64f3c420c5..aaf82159ee 100644
--- a/libavcodec/ffv1enc_template.c
+++ b/libavcodec/ffv1enc_template.c
@@ -38,6 +38,24 @@ RENAME(encode_line)(FFV1Context *f, FFV1SliceContext *sc,
     if (bits == 0)
         return 0;
 
+    if (sc->slice_coding_mode == 1) {
+        av_assert0(ac != AC_GOLOMB_RICE);
+        if (c->bytestream_end - c->bytestream < (w * bits + 7LL)>>3) {
+            av_log(logctx, AV_LOG_ERROR, "encoded Range Coder frame too large\n");
+            return AVERROR_INVALIDDATA;
+        }
+
+        for (x = 0; x < w; x++) {
+            int i;
+            int v = sample[0][x];
+            for (i = bits-1; i>=0; i--) {
+                uint8_t state = 128;
+                put_rac(c, &state, (v>>i) & 1);
+            }
+        }
+        return 0;
+    }
+
     if (ac != AC_GOLOMB_RICE) {
         if (c->bytestream_end - c->bytestream < w * 35) {
             av_log(logctx, AV_LOG_ERROR, "encoded Range Coder frame too large\n");
@@ -50,18 +68,6 @@ RENAME(encode_line)(FFV1Context *f, FFV1SliceContext *sc,
         }
     }
 
-    if (sc->slice_coding_mode == 1) {
-        for (x = 0; x < w; x++) {
-            int i;
-            int v = sample[0][x];
-            for (i = bits-1; i>=0; i--) {
-                uint8_t state = 128;
-                put_rac(c, &state, (v>>i) & 1);
-            }
-        }
-        return 0;
-    }
-
     for (x = 0; x < w; x++) {
         int diff, context;