[FFmpeg-cvslog] avcodec/hcom: Check the root entry and the right entries

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon Oct  7 16:56:11 2019 +0200| [4834ec926aa569cf25c797e22643d4735880b7a1] | committer: Michael Niedermayer

avcodec/hcom: Check the root entry and the right entries

Fixes: Segfault
Fixes: 17991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCOM_fuzzer-5647235349479424

Also fixes related memleak

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4834ec926aa569cf25c797e22643d4735880b7a1
---

 libavcodec/hcom.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libavcodec/hcom.c b/libavcodec/hcom.c
index 0559b050c3..8300676f98 100644
--- a/libavcodec/hcom.c
+++ b/libavcodec/hcom.c
@@ -66,8 +66,15 @@ static av_cold int hcom_init(AVCodecContext *avctx)
         s->dict[i].r = AV_RB16(avctx->extradata + 6 + 4 * i + 2);
         if (s->dict[i].l >= 0 &&
             (s->dict[i].l >= s->dict_entries ||
-             s->dict[i].r >= s->dict_entries))
+             s->dict[i].r >= s->dict_entries ||
+             s->dict[i].r < 0 )) {
+            av_freep(&s->dict);
             return AVERROR_INVALIDDATA;
+        }
+    }
+    if (s->dict[0].l < 0) {
+        av_freep(&s->dict);
+        return AVERROR_INVALIDDATA;
     }
 
     avctx->sample_fmt = AV_SAMPLE_FMT_U8;