RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-12 10:15:22 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/pictordec: Do not read more than nb_planes

Browse Source 
Fixes undefined behavior
Fixes: 622/clusterfuzz-testcase-5745722022428672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01d196a67d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-02-20 12:31:43 +01:00
parent ac73d88fbc
commit 04fc0a8244
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/pictordec.c
View File

@ -80,7 +80,7 @@ static void picmemset(PicContext *s, AVFrame *frame, int value, int run,
value <<= bits_per_plane; value <<= bits_per_plane;
mask <<= bits_per_plane; mask <<= bits_per_plane;
if (*plane >= s->nb_planes) if (*plane >= s->nb_planes)
break; return;
} }
} }
} }
@ -236,7 +236,7 @@ static int decode_frame(AVCodecContext *avctx,
} }
} }
if (x < avctx->width) { if (plane < s->nb_planes && x < avctx->width) {
int run = (y + 1) * avctx->width - x; int run = (y + 1) * avctx->width - x;
if (bits_per_plane == 8) if (bits_per_plane == 8)
picmemset_8bpp(s, frame, val, run, &x, &y); picmemset_8bpp(s, frame, val, run, &x, &y);