diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-15 23:28:25 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-07-08 08:42:41 +0200 |
| commit | 79204a1fc8f1988f7d7e6cae2c3b68f513444d38 (patch) | |
| tree | 9b0f5c6b00ecfaeb53ac06ee3d5c327062f8eaa2 /libavcodec/vc1_block.c | |
| parent | a6474b899c1153e3bb95e399b6605c3507aea0d0 (diff) | |
avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/vc1_block.c')
| -rw-r--r-- | libavcodec/vc1_block.c | 34 |
1 files changed, 26 insertions, 8 deletions
diff --git a/libavcodec/vc1_block.c b/libavcodec/vc1_block.c index 86320db959..ec5339d2f0 100644 --- a/libavcodec/vc1_block.c +++ b/libavcodec/vc1_block.c @@ -508,13 +508,15 @@ static inline int vc1_coded_block_pred(MpegEncContext * s, int n, * @param codingset set of VLC to decode data * @see 8.1.3.4 */ -static void vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip, +static int vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip, int *value, int codingset) { GetBitContext *gb = &v->s.gb; int index, run, level, lst, sign; index = get_vlc2(gb, ff_vc1_ac_coeff_table[codingset].table, AC_VLC_BITS, 3); + if (index < 0) + return index; if (index != ff_vc1_ac_sizes[codingset] - 1) { run = vc1_index_decode_table[codingset][index][0]; level = vc1_index_decode_table[codingset][index][1]; @@ -560,6 +562,8 @@ static void vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip, *last = lst; *skip = run; *value = (level ^ -sign) + sign; + + return 0; } /** Decode intra block in intra frames - should be faster than decode_intra_block @@ -639,7 +643,9 @@ static int vc1_decode_i_block(VC1Context *v, int16_t block[64], int n, zz_table = v->zz_8x8[1]; while (!last) { - vc1_decode_ac_coeff(v, &last, &skip, &value, codingset); + int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, codingset); + if (ret < 0) + return ret; i += skip; if (i > 63) break; @@ -812,7 +818,9 @@ static int vc1_decode_i_block_adv(VC1Context *v, int16_t block[64], int n, } while (!last) { - vc1_decode_ac_coeff(v, &last, &skip, &value, codingset); + int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, codingset); + if (ret < 0) + return ret; i += skip; if (i > 63) break; @@ -995,7 +1003,9 @@ static int vc1_decode_intra_block(VC1Context *v, int16_t block[64], int n, int k; while (!last) { - vc1_decode_ac_coeff(v, &last, &skip, &value, codingset); + int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, codingset); + if (ret < 0) + return ret; i += skip; if (i > 63) break; @@ -1161,7 +1171,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t block[64], int n, i = 0; last = 0; while (!last) { - vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); + int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); + if (ret < 0) + return ret; i += skip; if (i > 63) break; @@ -1189,7 +1201,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t block[64], int n, i = 0; off = (j & 1) * 4 + (j & 2) * 16; while (!last) { - vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); + int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); + if (ret < 0) + return ret; i += skip; if (i > 15) break; @@ -1216,7 +1230,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t block[64], int n, i = 0; off = j * 32; while (!last) { - vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); + int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); + if (ret < 0) + return ret; i += skip; if (i > 31) break; @@ -1243,7 +1259,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t block[64], int n, i = 0; off = j * 4; while (!last) { - vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); + int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); + if (ret < 0) + return ret; i += skip; if (i > 31) break; |