eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-16 20:10:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/rv60dec: Use get_bits_long()

Browse Source 
Fixes: 378634700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5008344043028480
Fixes: assertion failure

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2024-12-08 01:58:20 +01:00
parent 34c06f5284
commit 2336fc44ac
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/rv60dec.c
View File

@@ -395,10 +395,13 @@ static int read_slice_sizes(RV60Context *s, GetBitContext *gb)
for (int i = 0; i < s->cu_height; i++) for (int i = 0; i < s->cu_height; i++)
s->slice[i].sign = get_bits1(gb); s->slice[i].sign = get_bits1(gb);
s->slice[0].size = last_size = sum = get_bits(gb, nbits); s->slice[0].size = last_size = sum = get_bits_long(gb, nbits);
if (sum < 0)
return AVERROR_INVALIDDATA;
for (int i = 1; i < s->cu_height; i++) { for (int i = 1; i < s->cu_height; i++) {
int diff = get_bits(gb, nbits); int diff = get_bits_long(gb, nbits);
if (s->slice[i].sign) if (s->slice[i].sign)
last_size += diff; last_size += diff;
else else