avcodec/pixlet: consider minimum plane header in the minimal packet size

Fixes: Timeout Fixes: 46956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5698161106092032

Michael Niedermayer committed 4 years ago

Commit 4f9ee4b1 parent dd604061 file · +1 −1Browse files

Unified · Split

libavcodec/pixlet.c+1−1

@@ -611,7 +611,7 @@ static int pixlet_decode_frame(AVCodecContext avctx, AVFrame p, · 610 unmodified lines
611	bytestream2_init(&ctx->gb, avpkt->data, avpkt->size);	611	bytestream2_init(&ctx->gb, avpkt->data, avpkt->size);
612		612
613	pktsize = bytestream2_get_be32(&ctx->gb);	613	pktsize = bytestream2_get_be32(&ctx->gb);
614	if (pktsize <= 44 \|\| pktsize - 4 > bytestream2_get_bytes_left(&ctx->gb)) {	614	if (pktsize <= 44 + (NB_LEVELS * 8 + 6) * 3 \|\| pktsize - 4 > bytestream2_get_bytes_left(&ctx->gb)) {
615	av_log(avctx, AV_LOG_ERROR, "Invalid packet size %"PRIu32"\n", pktsize);	615	av_log(avctx, AV_LOG_ERROR, "Invalid packet size %"PRIu32"\n", pktsize);
616	return AVERROR_INVALIDDATA;	616	return AVERROR_INVALIDDATA;
617	}	617	}