Fixes: shift exponent -1 is negative Fixes: 429011224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5031059358285824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/ivi.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavcodec/ivi.c b/libavcodec/ivi.c index e7d8d10c3e0..a38f382d5f2 100644 --- a/libavcodec/ivi.c +++ b/libavcodec/ivi.c @@ -994,9 +994,11 @@ static int decode_band(IVI45DecContext *ctx, for (t = 0; t < band->num_tiles; t++) { tile = &band->tiles[t]; - if (tile->mb_size != band->mb_size) { - av_log(avctx, AV_LOG_ERROR, "MB sizes mismatch: %d vs. %d\n", - band->mb_size, tile->mb_size); + if (tile->mb_size != band->mb_size || + ctx->planes[0].bands[0].mb_size < band->mb_size + ) { + av_log(avctx, AV_LOG_ERROR, "MB sizes mismatch: %d vs. %d vs. %d\n", + band->mb_size, tile->mb_size, ctx->planes[0].bands[0].mb_size); return AVERROR_INVALIDDATA; } tile->is_empty = get_bits1(&ctx->gb); -- 2.49.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
