avcodec/dxv: Check coded_height, to avoid invalid av_clip()

Fixes: assertion failure Fixes: 438961582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5850827739955200

Michael Niedermayer committed 1 year ago

Commit 30b308f1 parent afc8c201 file · +2 −0Browse files

Unified · Split

@@ -940,6 +940,8 @@ static int dxv_decode(AVCodecContext avctx, AVFrame frame, · 939 unmodified lines
940	940	}
941	941	break;
942	942	}
	943	+ if (avctx->coded_height / 2 / TEXTURE_BLOCK_H < 1)
	944	+ return AVERROR_INVALIDDATA;
943	945
944	946	texdsp_ctx.slice_count = av_clip(avctx->thread_count, 1,
945	947	avctx->coded_height / TEXTURE_BLOCK_H);

Keyboard shortcuts