diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-11-22 00:31:47 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-04 17:20:41 +0100 |
| commit | a5ed6da9bdbe32408aabe1c75e4b55fcaeec1e9b (patch) | |
| tree | 1dbe9c4a30b3c4427229bfc52f4454bfeb118dfc | |
| parent | ab82c105787fa81d1e35b9209f3d53e98be936a4 (diff) | |
avcodec/rscc: Check inflated_buf size whan it is used
Fixes: out of array access
Fixes: 27434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5196757675540480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
| -rw-r--r-- | libavcodec/rscc.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c index bd0520950f..07a7c3dca3 100644 --- a/libavcodec/rscc.c +++ b/libavcodec/rscc.c @@ -300,6 +300,10 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data, ret = AVERROR_INVALIDDATA; goto end; } + if (ctx->inflated_size < pixel_size) { + ret = AVERROR_INVALIDDATA; + goto end; + } ret = uncompress(ctx->inflated_buf, &len, gbc->buffer, packed_size); if (ret) { av_log(avctx, AV_LOG_ERROR, "Pixel deflate error %d.\n", ret); |