diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-11 21:47:31 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-11 22:02:38 +0200 |
| commit | 5859b5b4394d3a0d654b6e821c2ba5e1e7842244 (patch) | |
| tree | 622acf171ee0876a8237a854324b69353e4215c7 /libavcodec/lagarithrac.h | |
| parent | 0561bd2fc2bff0dbe651d5998e9f129c43d25eb3 (diff) | |
| download | ffmpeg-5859b5b4394d3a0d654b6e821c2ba5e1e7842244.tar.gz | |
avcodec/lagarith: Detect end of input in lag_decode_line() loop
Fixes: timeout
Fixes: 2933/clusterfuzz-testcase-5124990208835584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/lagarithrac.h')
| -rw-r--r-- | libavcodec/lagarithrac.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/lagarithrac.h b/libavcodec/lagarithrac.h index dfdfea0db3..ee836d01db 100644 --- a/libavcodec/lagarithrac.h +++ b/libavcodec/lagarithrac.h @@ -47,6 +47,9 @@ typedef struct lag_rac { const uint8_t *bytestream; /**< Current position in input bytestream. */ const uint8_t *bytestream_end; /**< End position of input bytestream. */ + int overread; +#define MAX_OVERREAD 4 + uint32_t prob[258]; /**< Table of cumulative probability for each symbol. */ uint8_t range_hash[1024]; /**< Hash table mapping upper byte to approximate symbol. */ } lag_rac; @@ -62,6 +65,8 @@ static inline void lag_rac_refill(lag_rac *l) l->low |= 0xff & (AV_RB16(l->bytestream) >> 1); if (l->bytestream < l->bytestream_end) l->bytestream++; + else + l->overread++; } } |