diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-01-25 00:21:25 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-01-26 02:34:13 +0300 |
| commit | dd36b3a06a0ad2a4d5cc03912b9f9bae189b5eae (patch) | |
| tree | 3ace31cc44a872f5a03e630fe31993e063de61be /libavcodec/vp5.c | |
| parent | 14f555683a9844e5f8b5a544c066fb4f38074bb4 (diff) | |
avcodec/vp56: Check for the bitstream end, pass error codes on
Fixes timeout
Fixes: 446/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_VP6_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e6a2427558a718be0c1fffacffd935f630a7a8d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/vp5.c')
| -rw-r--r-- | libavcodec/vp5.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c index 6c664c6693..aba177c89f 100644 --- a/libavcodec/vp5.c +++ b/libavcodec/vp5.c @@ -170,7 +170,7 @@ static int vp5_parse_coeff_models(VP56Context *s) return 0; } -static void vp5_parse_coeff(VP56Context *s) +static int vp5_parse_coeff(VP56Context *s) { VP56RangeCoder *c = &s->c; VP56Model *model = s->modelp; @@ -180,6 +180,11 @@ static void vp5_parse_coeff(VP56Context *s) int b, i, cg, idx, ctx, ctx_last; int pt = 0; /* plane type (0 for Y, 1 for U or V) */ + if (c->end >= c->buffer && c->bits >= 0) { + av_log(s->avctx, AV_LOG_ERROR, "End of AC stream reached in vp5_parse_coeff\n"); + return AVERROR_INVALIDDATA; + } + for (b=0; b<6; b++) { int ct = 1; /* code type */ @@ -245,6 +250,7 @@ static void vp5_parse_coeff(VP56Context *s) s->coeff_ctx[ff_vp56_b6to4[b]][i] = 5; s->above_blocks[s->above_block_idx[b]].not_null_dc = s->coeff_ctx[ff_vp56_b6to4[b]][0]; } + return 0; } static void vp5_default_models_init(VP56Context *s) |