avcodec/vqavideo; Check bytestream2_get_buffer() reading next_codebook_buffer

Fixes: use of uninintilaized memory Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6235973619351552

Michael Niedermayer committed 1 year ago

Commit 44864db1 parent 7e9e7cb1 file · +6 −4Browse files

Unified · Split

@@ -571,8 +571,9 @@ static int vqa_decode_frame_pal8(VqaContext s, AVFrame frame) · 570 unmodified lines
571	571	}
572	572
573	573	/* accumulate partial codebook */
574		− bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
575		− chunk_size);
	574	+ if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
	575	+ chunk_size))
	576	+ return AVERROR_INVALIDDATA;
576	577	s->next_codebook_buffer_index += chunk_size;
577	578
578	579	s->partial_countdown--;
@@ -600,8 +601,9 @@ static int vqa_decode_frame_pal8(VqaContext s, AVFrame frame) · 21 unmodified lines
600	601	}
601	602
602	603	/* accumulate partial codebook */
603		− bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
604		− chunk_size);
	604	+ if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
	605	+ chunk_size))
	606	+ return AVERROR_INVALIDDATA;
605	607	s->next_codebook_buffer_index += chunk_size;
606	608
607	609	s->partial_countdown--;

Keyboard shortcuts