The rv60_qp_to_idx table only supports qp up to 31 on intra Fixes: global-buffer-overflow Fixes: 377543818/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5160167345291264
Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -1779,6 +1779,8 @@ static int decode_cu_r(RV60Context * s, AVFrame * frame, ThreadContext * thread, · 1778 unmodified lines | |||
| 1779 | ttype = cu.pu_type == PU_FULL ? TRANSFORM_8X8 : TRANSFORM_4X4; | 1779 | ttype = cu.pu_type == PU_FULL ? TRANSFORM_8X8 : TRANSFORM_4X4; |
| 1780 | 1780 | ||
| 1781 | is_intra = cu.cu_type == CU_INTRA; | 1781 | is_intra = cu.cu_type == CU_INTRA; |
| 1782 | if (is_intra && qp >= 32) | ||
| 1783 | return AVERROR_INVALIDDATA; | ||
| 1782 | cu_pos = ((xpos & 63) >> 3) + ((ypos & 63) >> 3) * 8; | 1784 | cu_pos = ((xpos & 63) >> 3) + ((ypos & 63) >> 3) * 8; |
| 1783 | 1785 | ||
| 1784 | switch (ttype) { | 1786 | switch (ttype) { |