Fixes: Timeout
Fixes: 9252/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5780720709533696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7007dabec08f2f9f81661e71ef482dde394e17a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
... | ... |
@@ -623,6 +623,11 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data, |
623 | 623 |
switch (cmd) { |
624 | 624 |
case FN_VERBATIM: |
625 | 625 |
len = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE); |
626 |
+ if (len < 0 || len > get_bits_left(&s->gb)) { |
|
627 |
+ av_log(avctx, AV_LOG_ERROR, "verbatim length %d invalid\n", |
|
628 |
+ len); |
|
629 |
+ return AVERROR_INVALIDDATA; |
|
630 |
+ } |
|
626 | 631 |
while (len--) |
627 | 632 |
get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE); |
628 | 633 |
break; |