[FFmpeg-cvslog] avcodec/lzf: Consider the needed size in reallocation

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Thu May 28 18:08:57 2020 +0200| [292b9b93a50aa0622e33013de9f2ddc130bef671] | committer: Michael Niedermayer

avcodec/lzf: Consider the needed size in reallocation

Fixes: NULL pointer dereference
Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=292b9b93a50aa0622e33013de9f2ddc130bef671
---

 libavcodec/lzf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c
index 5b7526ef18..1e3c86c88c 100644
--- a/libavcodec/lzf.c
+++ b/libavcodec/lzf.c
@@ -49,7 +49,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
         if (s < LZF_LITERAL_MAX) {
             s++;
             if (s > *size - len) {
-                *size += *size /2;
+                *size += s + *size /2;
                 ret = av_reallocp(buf, *size);
                 if (ret < 0)
                     return ret;
@@ -72,7 +72,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
                 return AVERROR_INVALIDDATA;
 
             if (l > *size - len) {
-                *size += *size / 2;
+                *size += l + *size / 2;
                 ret = av_reallocp(buf, *size);
                 if (ret < 0)
                     return ret;