diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-02-01 18:42:34 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-03-21 22:27:14 +0100 |
| commit | 4fdfe430c12225e819f68993474bd2f473c7e8b1 (patch) | |
| tree | b34ed74746511627ab6568d19bbadce8997af4f1 | |
| parent | 6bab6afecc513bfd242b5992547e8050cac8f95c (diff) | |
avcodec/av1dec: Check tile_cols
Fixes: division by zero
Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984
Fixes: 43950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5769210217758720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/av1dec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c index a274d8867e..613efc5d11 100644 --- a/libavcodec/av1dec.c +++ b/libavcodec/av1dec.c @@ -398,6 +398,9 @@ static int get_tiles_info(AVCodecContext *avctx, const AV1RawTileGroup *tile_gro s->tg_start = tile_group->tg_start; s->tg_end = tile_group->tg_end; + if (s->raw_frame_header->tile_cols == 0) + return AVERROR_INVALIDDATA; + for (tile_num = tile_group->tg_start; tile_num <= tile_group->tg_end; tile_num++) { tile_row = tile_num / s->raw_frame_header->tile_cols; tile_col = tile_num % s->raw_frame_header->tile_cols; |