MrBesen
/
ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header() 

Fixes: Timeout
Fixes: 33156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-6259655027326976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-04-19 15:50:43 +02:00
parent 9548dc74d8
commit 38c4761588
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/vc1.c
View File

@ -672,6 +672,8 @@ int ff_vc1_parse_frame_header(VC1Context *v, GetBitContext* gb)
if (v->s.pict_type == AV_PICTURE_TYPE_P)
v->rnd ^= 1;
if (get_bits_left(gb) < 5)
return AVERROR_INVALIDDATA;
/* Quantizer stuff */
pqindex = get_bits(gb, 5);
if (!pqindex)
@ -764,6 +766,9 @@ int ff_vc1_parse_frame_header(VC1Context *v, GetBitContext* gb)
av_log(v->s.avctx, AV_LOG_DEBUG, "MB Skip plane encoding: "
"Imode: %i, Invert: %i\n", status>>1, status&1);
if (get_bits_left(gb) < 4)
return AVERROR_INVALIDDATA;
/* Hopefully this is correct for P-frames */
v->s.mv_table_index = get_bits(gb, 2); //but using ff_vc1_ tables
v->cbptab = get_bits(gb, 2);