RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/snowdec: Check intra block dc differences. 

Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-11-15 21:17:15 +01:00
parent 5d7c76566c
commit c3b9bbcc6e
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libavcodec/snowdec.c
View File

@ -183,13 +183,22 @@ static int decode_q_branch(SnowContext *s, int level, int x, int y){
int my_context= av_log2(2*FFABS(left->my - top->my)) + 0*av_log2(2*FFABS(tr->my - top->my));
type= get_rac(&s->c, &s->block_state[1 + left->type + top->type]) ? BLOCK_INTRA : 0;
if(type){
int ld, cbd, crd;
pred_mv(s, &mx, &my, 0, left, top, tr);
l += get_symbol(&s->c, &s->block_state[32], 1);
ld = get_symbol(&s->c, &s->block_state[32], 1);
if (ld < -255 || ld > 255) {
return AVERROR_INVALIDDATA;
}
l += ld;
if (s->nb_planes > 2) {
cb+= get_symbol(&s->c, &s->block_state[64], 1);
cr+= get_symbol(&s->c, &s->block_state[96], 1);
cbd = get_symbol(&s->c, &s->block_state[64], 1);
crd = get_symbol(&s->c, &s->block_state[96], 1);
if (cbd < -255 || cbd > 255 || crd < -255 || crd > 255) {
return AVERROR_INVALIDDATA;
}
cb += cbd;
cr += crd;
}
}else{
if(s->ref_frames > 1)