diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-10-29 19:47:34 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-11-05 00:47:19 +0300 |
| commit | 1dc8d82da910972d308aebc1ee722044f83b9ccc (patch) | |
| tree | b25e010b5b04733a61d51b42bcec66eb52526b92 | |
| parent | 5280947fb6db37063334eae5b467cecd2417b063 (diff) | |
avcodec/alsdec: Check bits left before block decoding in non multi channel coding loop
Fixes: Timeout
Fixes: 52161/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-6440216563154944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
| -rw-r--r-- | libavcodec/alsdec.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index eab382e74f..4605b2248f 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -1660,7 +1660,8 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame) if (!sconf->mc_coding || ctx->js_switch) { int independent_bs = !sconf->joint_stereo; - + if (get_bits_left(gb) < 7*channels*ctx->num_blocks) + return AVERROR_INVALIDDATA; for (c = 0; c < channels; c++) { js_blocks[0] = 0; js_blocks[1] = 0; |