diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-05-28 19:08:57 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-06-08 01:21:15 +0300 |
| commit | 292b9b93a50aa0622e33013de9f2ddc130bef671 (patch) | |
| tree | d64f53adbd978569f222412a2a988b2fd0211246 /libavcodec/lzf.c | |
| parent | 5bd5c3108786bf69f108c55c375f1956f67ca7a4 (diff) | |
avcodec/lzf: Consider the needed size in reallocation
Fixes: NULL pointer dereference
Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/lzf.c')
| -rw-r--r-- | libavcodec/lzf.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c index 5b7526ef18..1e3c86c88c 100644 --- a/libavcodec/lzf.c +++ b/libavcodec/lzf.c @@ -49,7 +49,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size) if (s < LZF_LITERAL_MAX) { s++; if (s > *size - len) { - *size += *size /2; + *size += s + *size /2; ret = av_reallocp(buf, *size); if (ret < 0) return ret; @@ -72,7 +72,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size) return AVERROR_INVALIDDATA; if (l > *size - len) { - *size += *size / 2; + *size += l + *size / 2; ret = av_reallocp(buf, *size); if (ret < 0) return ret; |