diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-03 01:29:48 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-05 18:54:24 +0300 |
| commit | 43015afd7ce9055f1fa2d7648c3fcd9b7cfd7721 (patch) | |
| tree | c810934b084df99a3eb2aee9d749741d70f76266 /libavcodec/mss1.c | |
| parent | 8305a4509af2908d88bb623deb816fdaa8056c83 (diff) | |
avcodec/mss1: check for overread and forward errors
Fixes: Timeout (106sec -> 14ms)
Fixes: 15576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS1_fuzzer-5688080461201408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/mss1.c')
| -rw-r--r-- | libavcodec/mss1.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/mss1.c b/libavcodec/mss1.c index a579d9d9a4..84b7a37007 100644 --- a/libavcodec/mss1.c +++ b/libavcodec/mss1.c @@ -56,6 +56,8 @@ static void arith_normalise(ArithCoder *c) c->low <<= 1; c->high <<= 1; c->high |= 1; + if (get_bits_left(c->gbc.gb) < 1) + c->overread++; c->value |= get_bits1(c->gbc.gb); } } @@ -112,6 +114,7 @@ static void arith_init(ArithCoder *c, GetBitContext *gb) c->low = 0; c->high = 0xFFFF; c->value = get_bits(gb, 16); + c->overread = 0; c->gbc.gb = gb; c->get_model_sym = arith_get_model_sym; c->get_number = arith_get_number; |