[FFmpeg-devel] [PATCH 1/8] avcodec/cbs_sei_syntax_template: Check for non negativity before setting size_t bits_left

[Michael Niedermayer]

Fixes: Timeout
Fixes: 29892/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-6310830956216320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/cbs_sei_syntax_template.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/cbs_sei_syntax_template.c b/libavcodec/cbs_sei_syntax_template.c
index 9114e61ff6..3b9bc942f5 100644
--- a/libavcodec/cbs_sei_syntax_template.c
+++ b/libavcodec/cbs_sei_syntax_template.c
@@ -178,6 +178,8 @@ static int FUNC(message)(CodedBitstreamContext *ctx, RWContext *rw,
             GetBitContext tmp = *rw;
             int trailing_bits, trailing_zero_bits;
 
+            if (8 * current->payload_size < bits_written)
+                return AVERROR_INVALIDDATA;
             bits_left = 8 * current->payload_size - bits_written;
             if (bits_left > 8)
                 skip_bits_long(&tmp, bits_left - 8);
-- 
2.17.1