RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/vorbisdec: Check vlc for floor0 dec vector offset 

Fixes: out of array access
Fixes: 15649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5729191309344768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 99f95f39c6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-07-07 23:23:53 +02:00
parent 19866e4d63
commit c24ff0743f
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/vorbisdec.c
View File

@ -1128,8 +1128,10 @@ static int vorbis_floor0_decode(vorbis_context *vc,
ff_dlog(NULL, "floor0 dec: maximum depth: %d\n", codebook.maxdepth);
/* read temp vector */
vec_off = get_vlc2(&vc->gb, codebook.vlc.table,
codebook.nb_bits, codebook.maxdepth)
* codebook.dimensions;
codebook.nb_bits, codebook.maxdepth);
if (vec_off < 0)
return AVERROR_INVALIDDATA;
vec_off *= codebook.dimensions;
ff_dlog(NULL, "floor0 dec: vector offset: %d\n", vec_off);
/* copy each vector component and add last to it */
for (idx = 0; idx < codebook.dimensions; ++idx)