From 951bb7632fe6e3bb1a9c3b47610705871e471f34 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 25 Feb 2019 13:26:25 +0100 Subject: avcodec/aic: Check remaining bits in aic_decode_coeffs() Fixes: Timeout (78 seconds -> 2 seconds) Fixes: 13186/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5639516533030912 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/aic.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'libavcodec/aic.c') diff --git a/libavcodec/aic.c b/libavcodec/aic.c index 9c6f806655..dc28c83661 100644 --- a/libavcodec/aic.c +++ b/libavcodec/aic.c @@ -208,6 +208,9 @@ static int aic_decode_coeffs(GetBitContext *gb, int16_t *dst, int mb, idx; unsigned val; + if (get_bits_left(gb) < 5) + return AVERROR_INVALIDDATA; + has_skips = get_bits1(gb); coeff_type = get_bits1(gb); coeff_bits = get_bits(gb, 3); -- cgit v1.2.3