avcodec/rv60dec: Use get_bits_long()

Fixes: 378634700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5008344043028480
Fixes: assertion failure

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/391/head
Michael Niedermayer 1 month ago
parent 34c06f5284
commit 2336fc44ac
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
  1. 7
      libavcodec/rv60dec.c

@ -395,10 +395,13 @@ static int read_slice_sizes(RV60Context *s, GetBitContext *gb)
for (int i = 0; i < s->cu_height; i++)
s->slice[i].sign = get_bits1(gb);
s->slice[0].size = last_size = sum = get_bits(gb, nbits);
s->slice[0].size = last_size = sum = get_bits_long(gb, nbits);
if (sum < 0)
return AVERROR_INVALIDDATA;
for (int i = 1; i < s->cu_height; i++) {
int diff = get_bits(gb, nbits);
int diff = get_bits_long(gb, nbits);
if (s->slice[i].sign)
last_size += diff;
else

Loading…
Cancel
Save