Fixes: Assertion sc->slice_coding_mode == 0 failed at libavcodec/ffv1enc.c:1667 Fixes: 408838118/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-6493138204295168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/ffv1enc_template.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/libavcodec/ffv1enc_template.c b/libavcodec/ffv1enc_template.c index 64f3c420c51..aaf82159eef 100644 --- a/libavcodec/ffv1enc_template.c +++ b/libavcodec/ffv1enc_template.c @@ -38,19 +38,13 @@ RENAME(encode_line)(FFV1Context *f, FFV1SliceContext *sc, if (bits == 0) return 0; - if (ac != AC_GOLOMB_RICE) { - if (c->bytestream_end - c->bytestream < w * 35) { + if (sc->slice_coding_mode == 1) { + av_assert0(ac != AC_GOLOMB_RICE); + if (c->bytestream_end - c->bytestream < (w * bits + 7LL)>>3) { av_log(logctx, AV_LOG_ERROR, "encoded Range Coder frame too large\n"); return AVERROR_INVALIDDATA; } - } else { - if (put_bytes_left(&sc->pb, 0) < w * 4) { - av_log(logctx, AV_LOG_ERROR, "encoded Golomb Rice frame too large\n"); - return AVERROR_INVALIDDATA; - } - } - if (sc->slice_coding_mode == 1) { for (x = 0; x < w; x++) { int i; int v = sample[0][x]; @@ -62,6 +56,18 @@ RENAME(encode_line)(FFV1Context *f, FFV1SliceContext *sc, return 0; } + if (ac != AC_GOLOMB_RICE) { + if (c->bytestream_end - c->bytestream < w * 35) { + av_log(logctx, AV_LOG_ERROR, "encoded Range Coder frame too large\n"); + return AVERROR_INVALIDDATA; + } + } else { + if (put_bytes_left(&sc->pb, 0) < w * 4) { + av_log(logctx, AV_LOG_ERROR, "encoded Golomb Rice frame too large\n"); + return AVERROR_INVALIDDATA; + } + } + for (x = 0; x < w; x++) { int diff, context; -- 2.49.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
