From 5859b5b4394d3a0d654b6e821c2ba5e1e7842244 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 11 Aug 2017 21:47:31 +0200 Subject: avcodec/lagarith: Detect end of input in lag_decode_line() loop Fixes: timeout Fixes: 2933/clusterfuzz-testcase-5124990208835584 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/lagarith.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'libavcodec/lagarith.c') diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c index 860381746d..0f4aa89486 100644 --- a/libavcodec/lagarith.c +++ b/libavcodec/lagarith.c @@ -455,10 +455,12 @@ static int lag_decode_arith_plane(LagarithContext *l, uint8_t *dst, return -1; ff_lag_rac_init(&rac, &gb, length - stride); - - for (i = 0; i < height; i++) + for (i = 0; i < height; i++) { + if (rac.overread > MAX_OVERREAD) + return AVERROR_INVALIDDATA; read += lag_decode_line(l, &rac, dst + (i * stride), width, stride, esc_count); + } if (read > length) av_log(l->avctx, AV_LOG_WARNING, -- cgit v1.2.3