Fixes: out of array access Fixes: 385170375/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-4710055187906560
Unified · Split
| @@ -2257,7 +2257,7 @@ static int decode_slice(AVCodecContext *avctx, void *tdata, int cu_y, int thread · 2256 unmodified lines | ||
| 2257 | 2257 | thread.avg_linesize[1] = 32; |
| 2258 | 2258 | thread.avg_linesize[2] = 32; |
| 2259 | 2259 | |
| 2260 | − if ((ret = init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].size)) < 0) | |
| 2260 | + if ((ret = init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].data_size)) < 0) | |
| 2261 | 2261 | return ret; |
| 2262 | 2262 | |
| 2263 | 2263 | for (int cu_x = 0; cu_x < s->cu_width; cu_x++) { |