diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-09-11 13:03:54 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-09-16 21:30:59 +0200 |
| commit | 14e99cb47212a9b42956034337a00658bcace1ef (patch) | |
| tree | 6b85e34c80ce651eb1267e8439e6bd29719720d6 /libavcodec/hdrdec.c | |
| parent | 3993345f915bccceee315f44d412445346990e14 (diff) | |
avcodec/hdrdec: Update w in inner loop of decompress()
Fixes: out of array access
Fixes: 50936/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5423041009549312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/hdrdec.c')
| -rw-r--r-- | libavcodec/hdrdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c index 9b262f2ef2..7727826e2a 100644 --- a/libavcodec/hdrdec.c +++ b/libavcodec/hdrdec.c @@ -70,8 +70,8 @@ static int decompress(uint8_t *scanline, int w, GetByteContext *gb, const uint8_ for (int i = run << rshift; i > 0 && w > 0 && scanline >= start + 4; i--) { memcpy(scanline, scanline - 4, 4); scanline += 4; + w -= 4; } - w -= run << rshift; rshift += 8; if (rshift > 16) break; |