The rv60_qp_to_idx table only supports qp up to 31 on intra Fixes: global-buffer-overflow Fixes: 377543818/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5160167345291264
Unified · Split
| @@ -1779,6 +1779,8 @@ static int decode_cu_r(RV60Context * s, AVFrame * frame, ThreadContext * thread, · 1778 unmodified lines | ||
| 1779 | 1779 | ttype = cu.pu_type == PU_FULL ? TRANSFORM_8X8 : TRANSFORM_4X4; |
| 1780 | 1780 | |
| 1781 | 1781 | is_intra = cu.cu_type == CU_INTRA; |
| 1782 | + if (is_intra && qp >= 32) | |
| 1783 | + return AVERROR_INVALIDDATA; | |
| 1782 | 1784 | cu_pos = ((xpos & 63) >> 3) + ((ypos & 63) >> 3) * 8; |
| 1783 | 1785 | |
| 1784 | 1786 | switch (ttype) { |