diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-11 22:47:31 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-11 23:02:38 +0300 |
| commit | 5859b5b4394d3a0d654b6e821c2ba5e1e7842244 (patch) | |
| tree | 622acf171ee0876a8237a854324b69353e4215c7 /libavcodec/lagarith.c | |
| parent | 0561bd2fc2bff0dbe651d5998e9f129c43d25eb3 (diff) | |
avcodec/lagarith: Detect end of input in lag_decode_line() loop
Fixes: timeout
Fixes: 2933/clusterfuzz-testcase-5124990208835584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/lagarith.c')
| -rw-r--r-- | libavcodec/lagarith.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c index 860381746d..0f4aa89486 100644 --- a/libavcodec/lagarith.c +++ b/libavcodec/lagarith.c @@ -455,10 +455,12 @@ static int lag_decode_arith_plane(LagarithContext *l, uint8_t *dst, return -1; ff_lag_rac_init(&rac, &gb, length - stride); - - for (i = 0; i < height; i++) + for (i = 0; i < height; i++) { + if (rac.overread > MAX_OVERREAD) + return AVERROR_INVALIDDATA; read += lag_decode_line(l, &rac, dst + (i * stride), width, stride, esc_count); + } if (read > length) av_log(l->avctx, AV_LOG_WARNING, |