ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-19 21:06:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/ffv1dec: Check state transition table

Browse Source 
Fixes: Timeout
Fixes: 8646/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5649968353247232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-06-21 22:10:23 +02:00
parent 6677c98626
commit 84bbdc255a
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/ffv1dec.c
View File

@ -546,8 +546,14 @@ static int read_header(FFV1Context *f)
f->ac = get_symbol(c, state, 0);
if (f->ac == AC_RANGE_CUSTOM_TAB) {
for (i = 1; i < 256; i++)
f->state_transition[i] = get_symbol(c, state, 1) + c->one_state[i];
for (i = 1; i < 256; i++) {
int st = get_symbol(c, state, 1) + c->one_state[i];
if (st < 1 || st > 255) {
av_log(f->avctx, AV_LOG_ERROR, "invalid state transition %d\n", st);
return AVERROR_INVALIDDATA;
}
f->state_transition[i] = st;
}
}
colorspace = get_symbol(c, state, 0); //YUV cs type