diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-01-24 22:21:25 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-01-24 23:01:04 +0100 |
| commit | 9e6a2427558a718be0c1fffacffd935f630a7a8d (patch) | |
| tree | f448b2d0e5e502c15d4bc5ab6ec4e4b2e5a86d69 /libavcodec/vp5.c | |
| parent | 9f10cff61042dbc0c27efd2dea7f1d3da83eff1b (diff) | |
| download | ffmpeg-9e6a2427558a718be0c1fffacffd935f630a7a8d.tar.gz | |
avcodec/vp56: Check for the bitstream end, pass error codes on
Fixes timeout
Fixes: 446/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_VP6_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/vp5.c')
| -rw-r--r-- | libavcodec/vp5.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c index 6c664c6693..aba177c89f 100644 --- a/libavcodec/vp5.c +++ b/libavcodec/vp5.c @@ -170,7 +170,7 @@ static int vp5_parse_coeff_models(VP56Context *s) return 0; } -static void vp5_parse_coeff(VP56Context *s) +static int vp5_parse_coeff(VP56Context *s) { VP56RangeCoder *c = &s->c; VP56Model *model = s->modelp; @@ -180,6 +180,11 @@ static void vp5_parse_coeff(VP56Context *s) int b, i, cg, idx, ctx, ctx_last; int pt = 0; /* plane type (0 for Y, 1 for U or V) */ + if (c->end >= c->buffer && c->bits >= 0) { + av_log(s->avctx, AV_LOG_ERROR, "End of AC stream reached in vp5_parse_coeff\n"); + return AVERROR_INVALIDDATA; + } + for (b=0; b<6; b++) { int ct = 1; /* code type */ @@ -245,6 +250,7 @@ static void vp5_parse_coeff(VP56Context *s) s->coeff_ctx[ff_vp56_b6to4[b]][i] = 5; s->above_blocks[s->above_block_idx[b]].not_null_dc = s->coeff_ctx[ff_vp56_b6to4[b]][0]; } + return 0; } static void vp5_default_models_init(VP56Context *s) |