mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/shorten: Check verbatim length
Fixes: Timeout
Fixes: 9252/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5780720709533696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7007dabec0
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
c0a6febf32
commit
2c3ea34082
|
@ -623,6 +623,11 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
|
||||||
switch (cmd) {
|
switch (cmd) {
|
||||||
case FN_VERBATIM:
|
case FN_VERBATIM:
|
||||||
len = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);
|
len = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);
|
||||||
|
if (len < 0 || len > get_bits_left(&s->gb)) {
|
||||||
|
av_log(avctx, AV_LOG_ERROR, "verbatim length %d invalid\n",
|
||||||
|
len);
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
}
|
||||||
while (len--)
|
while (len--)
|
||||||
get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);
|
get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);
|
||||||
break;
|
break;
|
||||||
|
|
Loading…
Reference in New Issue