From 2baf36caed98cfdc7f6a2086fbf26f1a172f16cf Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 15 Nov 2016 18:05:33 +0100 Subject: [PATCH] avcodec/ituh263dec: Avoid spending a long time in slice sync Fixes: 177/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_FLV1_fuzzer Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/ituh263dec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/ituh263dec.c b/libavcodec/ituh263dec.c index a26244f393..5e3c0eac07 100644 --- a/libavcodec/ituh263dec.c +++ b/libavcodec/ituh263dec.c @@ -167,6 +167,7 @@ static int h263_decode_gob_header(MpegEncContext *s) /* We have a GBSC probably with GSTUFF */ skip_bits(&s->gb, 16); /* Drop the zeros */ left= get_bits_left(&s->gb); + left = FFMIN(left, 32); //MN: we must check the bits left or we might end in an infinite loop (or segfault) for(;left>13; left--){ if(get_bits1(&s->gb)) break; /* Seek the '1' bit */