ffmpeg | branch: master | Michael Niedermayer <mich...@niedermayer.cc> | Sun May 11 01:35:29 2025 +0200| [c06f5b3ab97b1b1d0420309201568e38b3920860] | committer: Michael Niedermayer
avcodec/svq3: Check there are bits left before decompression Fixes: out of array read Fixes: 402587670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-6343867775647744 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c06f5b3ab97b1b1d0420309201568e38b3920860 --- libavcodec/svq3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index f730358e2f..6319e9b021 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -1253,6 +1253,7 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx) uint8_t *buf; if (watermark_height <= 0 || + get_bits_left(&gb) <= 0 || (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height) return AVERROR_INVALIDDATA; _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
