mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-03-17 20:17:55 +02:00
avcodec/indeo2: Check for invalid VLCs
Fixes: timeout Fixes: 1416/clusterfuzz-testcase-minimized-5536862435278848 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 159fb8ff7e4038edf13e91d3c08bc7b8abc369b9) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
c152707dc1
commit
bac7b59542
@ -68,6 +68,8 @@ static int ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *dst
|
||||
for (i = 0; i < c * 2; i++)
|
||||
dst[out++] = 0x80;
|
||||
} else { /* copy two values from table */
|
||||
if (c <= 0)
|
||||
return AVERROR_INVALIDDATA;
|
||||
dst[out++] = table[c * 2];
|
||||
dst[out++] = table[(c * 2) + 1];
|
||||
}
|
||||
@ -89,7 +91,10 @@ static int ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *dst
|
||||
out++;
|
||||
}
|
||||
} else { /* add two deltas from table */
|
||||
int t = dst[out - pitch] + (table[c * 2] - 128);
|
||||
int t;
|
||||
if (c <= 0)
|
||||
return AVERROR_INVALIDDATA;
|
||||
t = dst[out - pitch] + (table[c * 2] - 128);
|
||||
t = av_clip_uint8(t);
|
||||
dst[out] = t;
|
||||
out++;
|
||||
@ -125,6 +130,8 @@ static int ir2_decode_plane_inter(Ir2Context *ctx, int width, int height, uint8_
|
||||
c -= 0x7F;
|
||||
out += c * 2;
|
||||
} else { /* add two deltas from table */
|
||||
if (c <= 0)
|
||||
return AVERROR_INVALIDDATA;
|
||||
t = dst[out] + (((table[c * 2] - 128)*3) >> 2);
|
||||
t = av_clip_uint8(t);
|
||||
dst[out] = t;
|
||||
|
Loading…
x
Reference in New Issue
Block a user