diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-01-01 22:32:04 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-01-30 19:57:25 +0100 |
| commit | 2b5b9d5dac9a3525d7330662724c0e9045078bfb (patch) | |
| tree | 0b67748e037be600f1b561c580da84aef052ac1e /libavcodec/rawdec.c | |
| parent | 8652f4e7a15e56fadf9697188c1ed42c9981db82 (diff) | |
avcodec/rawdec: Use linesize in b64a
Fixes: out of array access
Fixes: 19750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5074834119983104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/rawdec.c')
| -rw-r--r-- | libavcodec/rawdec.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c index 0b2d8708e6..a110a690f5 100644 --- a/libavcodec/rawdec.c +++ b/libavcodec/rawdec.c @@ -467,10 +467,13 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame, avctx->pix_fmt == AV_PIX_FMT_RGBA64BE) { uint8_t *dst = frame->data[0]; uint64_t v; - int x; - for (x = 0; x >> 3 < avctx->width * avctx->height; x += 8) { - v = AV_RB64(&dst[x]); - AV_WB64(&dst[x], v << 16 | v >> 48); + int x, y; + for (y = 0; y < avctx->height; y++) { + for (x = 0; x >> 3 < avctx->width; x += 8) { + v = AV_RB64(&dst[x]); + AV_WB64(&dst[x], v << 16 | v >> 48); + } + dst += frame->linesize[0]; } } |