Fixes: index 2304 out of bounds for type 'float [2304]'
Fixes: 16332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5679142481166336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12b909ba319d32ed100d9b26021aa9b6976424d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
... | ... |
@@ -1727,6 +1727,11 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx) |
1727 | 1727 |
s->sub_sampling = s->fft_order - 7; |
1728 | 1728 |
s->frequency_range = 255 / (1 << (2 - s->sub_sampling)); |
1729 | 1729 |
|
1730 |
+ if (s->frame_size * 4 >> s->sub_sampling > MPA_FRAME_SIZE) { |
|
1731 |
+ avpriv_request_sample(avctx, "large frames"); |
|
1732 |
+ return AVERROR_PATCHWELCOME; |
|
1733 |
+ } |
|
1734 |
+ |
|
1730 | 1735 |
switch ((s->sub_sampling * 2 + s->channels - 1)) { |
1731 | 1736 |
case 0: tmp = 40; break; |
1732 | 1737 |
case 1: tmp = 48; break; |