Michael Niedermayer ebdcf98499 avcodec/truemotion1: Height not being a multiple of 4 is unsupported ...

mb_change_bits is given space based on height >> 2, while more data is read

Fixes: out of array access
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5201925062590464.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

2024-03-26 23:19:49 +01:00

28 KiB

Raw Blame History

View Raw