The true problem happens in several previous get_vlc_symbol() but checking that is more expensive (involving FFABS()) here its just a simple check between 2 variables we have. Fixes: Assertion log >= k failed at libavcodec/golomb.h:406 Fixes: 429296194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_DEC_fuzzer-4691594622337024
Unified · Split
| @@ -56,6 +56,11 @@ static inline int get_vlc_symbol(GetBitContext *gb, VlcState *const state, · 55 unmodified lines | ||
| 56 | 56 | k++; |
| 57 | 57 | i += i; |
| 58 | 58 | } |
| 59 | + if (k > bits) { | |
| 60 | + ff_dlog(NULL, "k-overflow bias:%d error:%d drift:%d count:%d k:%d", | |
| 61 | + state->bias, state->error_sum, state->drift, state->count, k); | |
| 62 | + k = bits; | |
| 63 | + } | |
| 59 | 64 | |
| 60 | 65 | v = get_sr_golomb(gb, k, 12, bits); |
| 61 | 66 | ff_dlog(NULL, "v:%d bias:%d error:%d drift:%d count:%d k:%d", |