virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-07-11 14:30:22 +02:00
Code Issues Releases Activity

avcodec/apedec: Check remaining space in decode_array_0000()

Browse Source 
Fixes: Timeout (? -> 2sec)
Fixes: 17886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5728165124636672
Fixes: 18131/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5710803432374272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2019-10-05 18:39:05 +02:00
parent 926221ef84
commit 7b94b22261
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/apedec.c
View File

@ -609,6 +609,10 @@ static void decode_array_0000(APEContext *ctx, GetBitContext *gb,
ksummax = 1 << rice->k + 7; ksummax = 1 << rice->k + 7;
ksummin = rice->k ? (1 << rice->k + 6) : 0; ksummin = rice->k ? (1 << rice->k + 6) : 0;
for (; i < blockstodecode; i++) { for (; i < blockstodecode; i++) {
if (get_bits_left(&ctx->gb) < 1) {
ctx->error = 1;
return ;
}
out[i] = get_rice_ook(&ctx->gb, rice->k); out[i] = get_rice_ook(&ctx->gb, rice->k);
rice->ksum += out[i] - out[i - 64]; rice->ksum += out[i] - out[i - 64];
while (rice->ksum < ksummin) { while (rice->ksum < ksummin) {