[FFmpeg-devel] [PATCH 7/7] avcodec/cri: check for available input in unpack_10bit()

[Paul B Mahol]

On Tue, Nov 10, 2020 at 12:15 AM Michael Niedermayer <michael at niedermayer.cc>
wrote:

> Fixes: Timeout (>20sec -> 56ms)
> Fixes:
> 26995/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5107217080254464
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/cri.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/libavcodec/cri.c b/libavcodec/cri.c
> index dafbc1f1be..9bcd2ebfc6 100644
> --- a/libavcodec/cri.c
> +++ b/libavcodec/cri.c
> @@ -80,10 +80,13 @@ static void unpack_10bit(GetByteContext *gb, uint16_t
> *dst, int shift,
>      int pos = 0;
>
>      while (count > 0) {
> -        uint32_t a0 = bytestream2_get_le32(gb);
> -        uint32_t a1 = bytestream2_get_le32(gb);
> -        uint32_t a2 = bytestream2_get_le32(gb);
> -        uint32_t a3 = bytestream2_get_le32(gb);
> +        uint32_t a0, a1,a2,a3;
>

Why style issue is very bad here?


> +        if (bytestream2_get_bytes_left(gb) < 4)
>

This should be 16, not 4.


> +            break;
> +        a0 = bytestream2_get_le32(gb);
> +        a1 = bytestream2_get_le32(gb);
> +        a2 = bytestream2_get_le32(gb);
> +        a3 = bytestream2_get_le32(gb);
>          dst[pos] = (((a0 >> 1) & 0xE00) | (a0 & 0x1FF)) << shift;
>          pos++;
>          if (pos >= w) {
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".