RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-26 01:02:33 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/mpeg4videodec: consider lowres in dest_pcm[]

Browse Source 
Fixes: out of array access
Fixes: 59999/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5767982157266944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-07-23 19:01:37 +02:00
parent 94bd1796ff
commit d48476183f
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/mpeg4videodec.c
View File

@ -295,7 +295,7 @@ void ff_mpeg4_decode_studio(MpegEncContext *s, uint8_t *dest_y, uint8_t *dest_cb
int hsub = i ? s->chroma_x_shift : 0;
int lowres = s->avctx->lowres;
int step = 1 << lowres;
dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub) - 1);
dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub + lowres) - 1);
for (int h = (16 >> (vsub + lowres)) - 1; h >= 0; h--){
for (int w = (16 >> (hsub + lowres)) - 1, idx = 0; w >= 0; w--, idx += step)
dest_pcm[i][w] = src[idx];