History

avcodec/dxv: Check coded_height, to avoid invalid av_clip()

Fixes: assertion failure Fixes: 438961582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5850827739955200

Michael Niedermayer committed 1 year ago

Commit 30b308f1 parent afc8c201 file · +2 −0Browse files

Showing the changes to libavcodec (1 of 1 file). Show all

Unified · Split

libavcodec/dxv.c+2−0
@@ -940,6 +940,8 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame, · 939 unmodified lines
940 }940 }
941 break;941 break;
942 }942 }
943 if (avctx->coded_height / 2 / TEXTURE_BLOCK_H < 1)
944 return AVERROR_INVALIDDATA;
943 945
944 texdsp_ctx.slice_count = av_clip(avctx->thread_count, 1,946 texdsp_ctx.slice_count = av_clip(avctx->thread_count, 1,
945 avctx->coded_height / TEXTURE_BLOCK_H);947 avctx->coded_height / TEXTURE_BLOCK_H);

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t