wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avcodec/rv60dec: inter also fails with qp >= 32

Browse source 
Fixes: out of array read in decode_cu_16x16()
Fixes: 398049430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5525836849807360

Reviewed-by: Peter Ross <pross@xvid.org>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2025-05-08 23:42:13 +02:00
parent ce1fd73d63
commit 9230c93cc9
No known key found for this signature in database
GPG key ID: B18E8928B3948D64
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
libavcodec/rv60dec.c
View file

@ -1791,7 +1791,7 @@ static int decode_cu_r(RV60Context * s, AVFrame * frame, ThreadContext * thread,
ttype = cu.pu_type == PU_FULL ? TRANSFORM_8X8 : TRANSFORM_4X4;
is_intra = cu.cu_type == CU_INTRA;
if (is_intra && qp >= 32)
if (qp >= 32)
return AVERROR_INVALIDDATA;
cu_pos = ((xpos & 63) >> 3) + ((ypos & 63) >> 3) * 8;