[FFmpeg-cvslog] avcodec/svq1dec: Check that there is data left after the header

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer <michael at niedermayer.cc> | Tue Feb 18 23:28:33 2020 +0100| [54ec335e83890aee325fe17267d951e78060c0f2] | committer: Michael Niedermayer

avcodec/svq1dec: Check that there is data left after the header

Fixes: Timeout (21sec -> 255ms)
Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 55e344ee5aa6f6e04e50bbac457e0ca53433ab75)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=54ec335e83890aee325fe17267d951e78060c0f2
---

 libavcodec/svq1dec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c
index dca99fae4c..0485245a80 100644
--- a/libavcodec/svq1dec.c
+++ b/libavcodec/svq1dec.c
@@ -602,6 +602,8 @@ static int svq1_decode_frame_header(AVCodecContext *avctx, AVFrame *frame)
         if (skip_1stop_8data_bits(bitbuf) < 0)
             return AVERROR_INVALIDDATA;
     }
+    if (get_bits_left(bitbuf) <= 0)
+        return AVERROR_INVALIDDATA;
 
     s->width  = width;
     s->height = height;