Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/cri: check for available input in unpack_10bit()

Browse Source 
Fixes: Timeout (>20sec -> 56ms)
Fixes: 26995/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5107217080254464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/371/head
Michael Niedermayer 4 years ago
parent 1b373b41d9
commit 43c8d3097b
1 changed files with 7 additions and 4 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 11
      libavcodec/cri.c

11
libavcodec/cri.c
Unescape View File

@ -80,10 +80,13 @@ static void unpack_10bit(GetByteContext *gb, uint16_t *dst, int shift,
int pos = 0; int pos = 0;
while (count > 0) { while (count > 0) {
uint32_t a0 = bytestream2_get_le32(gb); uint32_t a0, a1,a2,a3;
uint32_t a1 = bytestream2_get_le32(gb); if (bytestream2_get_bytes_left(gb) < 4)
uint32_t a2 = bytestream2_get_le32(gb); break;
uint32_t a3 = bytestream2_get_le32(gb); a0 = bytestream2_get_le32(gb);
a1 = bytestream2_get_le32(gb);
a2 = bytestream2_get_le32(gb);
a3 = bytestream2_get_le32(gb);
dst[pos] = (((a0 >> 1) & 0xE00) | (a0 & 0x1FF)) << shift; dst[pos] = (((a0 >> 1) & 0xE00) | (a0 & 0x1FF)) << shift;
pos++; pos++;
if (pos >= w) { if (pos >= w) {

Write Preview
Loading…
Cancel
Save