diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-08-13 00:44:48 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-08-20 02:32:41 +0200 |
| commit | 2c1613ac94d07fd85e8831bb7aa7eb4bec707285 (patch) | |
| tree | 36ddc98203553d6af4e1fd057e5c2c690e690932 /libavcodec/cfhd.c | |
| parent | dbac849c4db9c9378ab6e55f4f489debf2659b04 (diff) | |
avcodec/cfhd: Move peak_table() and difference_coding() calls after the existing coefficient count check
Fixes: out of array access
Fixes: 9509/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5283250636324864
Fixes: 9572/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4920757409808384
Fixes: 9596/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5114917580439552
Fixes: 9640/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-6247840698335232
Fixes: 9659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-6079554987753472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/cfhd.c')
| -rw-r--r-- | libavcodec/cfhd.c | 14 |
1 files changed, 4 insertions, 10 deletions
diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 76838f0869..1959762f0e 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -668,11 +668,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, for (i = 0; i < run; i++) *coeff_data++ = coeff; } - if (s->peak.level) - peak_table(coeff_data - expected, &s->peak, expected); - if (s->difference_coding) - difference_coding(s->plane[s->channel_num].subband[s->subband_num_actual], highpass_width, highpass_height); - } else { while (1) { UPDATE_CACHE(re, &s->gb); @@ -692,11 +687,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, for (i = 0; i < run; i++) *coeff_data++ = coeff; } - if (s->peak.level) - peak_table(coeff_data - expected, &s->peak, expected); - if (s->difference_coding) - difference_coding(s->plane[s->channel_num].subband[s->subband_num_actual], highpass_width, highpass_height); - } CLOSE_READER(re, &s->gb); } @@ -706,6 +696,10 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, ret = AVERROR(EINVAL); goto end; } + if (s->peak.level) + peak_table(coeff_data - expected, &s->peak, expected); + if (s->difference_coding) + difference_coding(s->plane[s->channel_num].subband[s->subband_num_actual], highpass_width, highpass_height); bytes = FFALIGN(AV_CEIL_RSHIFT(get_bits_count(&s->gb), 3), 4); if (bytes > bytestream2_get_bytes_left(&gb)) { |