diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-07-23 19:01:37 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-09-08 01:32:30 +0200 |
| commit | d48476183fad230c8e457b2f314f8e136b973c4e (patch) | |
| tree | 5efa559b31fcffe4fb328cfa8fb35be4f941af47 | |
| parent | 94bd1796ff45b396021cd260e9b037bc61815933 (diff) | |
avcodec/mpeg4videodec: consider lowres in dest_pcm[]
Fixes: out of array access
Fixes: 59999/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5767982157266944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/mpeg4videodec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c index 72bf9eb115..256215cb81 100644 --- a/libavcodec/mpeg4videodec.c +++ b/libavcodec/mpeg4videodec.c @@ -295,7 +295,7 @@ void ff_mpeg4_decode_studio(MpegEncContext *s, uint8_t *dest_y, uint8_t *dest_cb int hsub = i ? s->chroma_x_shift : 0; int lowres = s->avctx->lowres; int step = 1 << lowres; - dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub) - 1); + dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub + lowres) - 1); for (int h = (16 >> (vsub + lowres)) - 1; h >= 0; h--){ for (int w = (16 >> (hsub + lowres)) - 1, idx = 0; w >= 0; w--, idx += step) dest_pcm[i][w] = src[idx]; |