RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/mobiclip: Check quantizer before table setup 

Fixes: index -1 out of bounds for type 'const uint8_t [6][16]'
Fixes: out of array read
Fixes: shift exponent -21 is negative
Fixes: 25422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5748258226569216
Fixes: shift exponent 8039082 is too large for 32-bit type 'int'
Fixes: 25430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5698567770210304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-09-10 23:59:53 +02:00
parent ca49476ace
commit bad8b17a3d
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/mobiclip.c
View File

@ -1323,6 +1323,10 @@ static int mobiclip_decode(AVCodecContext *avctx, void *data,
}
} else {
MotionXY *motion = s->motion;
int quantizer = s->quantizer + get_se_golomb(gb);
if (quantizer < 12 || quantizer > 161)
return AVERROR_INVALIDDATA;
memset(motion, 0, s->motion_size);
@ -1330,7 +1334,7 @@ static int mobiclip_decode(AVCodecContext *avctx, void *data,
frame->key_frame = 0;
s->dct_tab_idx = 0;
setup_qtables(avctx, s->quantizer + get_se_golomb(gb));
setup_qtables(avctx, quantizer);
for (int y = 0; y < avctx->height; y += 16) {
for (int x = 0; x < avctx->width; x += 16) {
int idx;