diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-14 23:21:03 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-20 15:33:13 +0200 |
| commit | bc9686c85beb15cb87d492bfbea03c91d5317a11 (patch) | |
| tree | f02dd7ad7329bfea711c7e2e705ab5f308f32300 /libavcodec/cri.c | |
| parent | be852803eb3b5628a45f91d298c924be038c2ff7 (diff) | |
avcodec/cri: Check for end of image in unpack_10bit()
Fixes: out of array write
Fixes: 26242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5161495882891264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/cri.c')
| -rw-r--r-- | libavcodec/cri.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/libavcodec/cri.c b/libavcodec/cri.c index 3aad76a008..dafbc1f1be 100644 --- a/libavcodec/cri.c +++ b/libavcodec/cri.c @@ -87,54 +87,72 @@ static void unpack_10bit(GetByteContext *gb, uint16_t *dst, int shift, dst[pos] = (((a0 >> 1) & 0xE00) | (a0 & 0x1FF)) << shift; pos++; if (pos >= w) { + if (count == 1) + break; dst += stride; pos = 0; } dst[pos] = (((a0 >> 13) & 0x3F) | ((a0 >> 14) & 0xFC0)) << shift; pos++; if (pos >= w) { + if (count == 2) + break; dst += stride; pos = 0; } dst[pos] = (((a0 >> 26) & 7) | ((a1 & 0x1FF) << 3)) << shift; pos++; if (pos >= w) { + if (count == 3) + break; dst += stride; pos = 0; } dst[pos] = (((a1 >> 10) & 0x1FF) | ((a1 >> 11) & 0xE00)) << shift; pos++; if (pos >= w) { + if (count == 4) + break; dst += stride; pos = 0; } dst[pos] = (((a1 >> 23) & 0x3F) | ((a2 & 0x3F) << 6)) << shift; pos++; if (pos >= w) { + if (count == 5) + break; dst += stride; pos = 0; } dst[pos] = (((a2 >> 7) & 0xFF8) | ((a2 >> 6) & 7)) << shift; pos++; if (pos >= w) { + if (count == 6) + break; dst += stride; pos = 0; } dst[pos] = (((a3 & 7) << 9) | ((a2 >> 20) & 0x1FF)) << shift; pos++; if (pos >= w) { + if (count == 7) + break; dst += stride; pos = 0; } dst[pos] = (((a3 >> 4) & 0xFC0) | ((a3 >> 3) & 0x3F)) << shift; pos++; if (pos >= w) { + if (count == 8) + break; dst += stride; pos = 0; } dst[pos] = (((a3 >> 16) & 7) | ((a3 >> 17) & 0xFF8)) << shift; pos++; if (pos >= w) { + if (count == 9) + break; dst += stride; pos = 0; } |