Commit 78b95530 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/ffv1dec: Check for min packet size

Fixes: Timeout
Fixes: 48619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5793597923917824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent ba0c3d1d
......@@ -879,6 +879,14 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
p->key_frame = 0;
}
if (f->ac != AC_GOLOMB_RICE) {
if (buf_size < avctx->width * avctx->height / (128*8))
return AVERROR_INVALIDDATA;
} else {
if (buf_size < avctx->height / 8)
return AVERROR_INVALIDDATA;
}
ret = ff_thread_get_ext_buffer(avctx, &f->picture, AV_GET_BUFFER_FLAG_REF);
if (ret < 0)
return ret;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment