RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/pictordec: Do not read more than nb_planes 

Fixes undefined behavior
Fixes: 622/clusterfuzz-testcase-5745722022428672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01d196a67d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-02-20 12:31:43 +01:00
parent ac73d88fbc
commit 04fc0a8244
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/pictordec.c
View File

@ -80,7 +80,7 @@ static void picmemset(PicContext *s, AVFrame *frame, int value, int run,
value <<= bits_per_plane;
mask <<= bits_per_plane;
if (*plane >= s->nb_planes)
break;
return;
}
}
}
@ -236,7 +236,7 @@ static int decode_frame(AVCodecContext *avctx,
}
}
if (x < avctx->width) {
if (plane < s->nb_planes && x < avctx->width) {
int run = (y + 1) * avctx->width - x;
if (bits_per_plane == 8)
picmemset_8bpp(s, frame, val, run, &x, &y);