Fixes: writing in a null pointer Fixes: 435278398/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APV_fuzzer-4566392923029504
Unified · Split
| @@ -52,9 +52,9 @@ typedef struct APVDecodeContext { · 51 unmodified lines | ||
| 52 | 52 | static const enum AVPixelFormat apv_format_table[5][5] = { |
| 53 | 53 | { AV_PIX_FMT_GRAY8, AV_PIX_FMT_GRAY10, AV_PIX_FMT_GRAY12, AV_PIX_FMT_GRAY14, AV_PIX_FMT_GRAY16 }, |
| 54 | 54 | { 0 }, // 4:2:0 is not valid. |
| 55 | − { AV_PIX_FMT_YUV422P, AV_PIX_FMT_YUV422P10, AV_PIX_FMT_YUV422P12, AV_PIX_FMT_GRAY14, AV_PIX_FMT_YUV422P16 }, | |
| 56 | − { AV_PIX_FMT_YUV444P, AV_PIX_FMT_YUV444P10, AV_PIX_FMT_YUV444P12, AV_PIX_FMT_GRAY14, AV_PIX_FMT_YUV444P16 }, | |
| 57 | − { AV_PIX_FMT_YUVA444P, AV_PIX_FMT_YUVA444P10, AV_PIX_FMT_YUVA444P12, AV_PIX_FMT_GRAY14, AV_PIX_FMT_YUVA444P16 }, | |
| 55 | + { AV_PIX_FMT_YUV422P, AV_PIX_FMT_YUV422P10, AV_PIX_FMT_YUV422P12, AV_PIX_FMT_YUV422P14, AV_PIX_FMT_YUV422P16 }, | |
| 56 | + { AV_PIX_FMT_YUV444P, AV_PIX_FMT_YUV444P10, AV_PIX_FMT_YUV444P12, AV_PIX_FMT_YUV444P14, AV_PIX_FMT_YUV444P16 }, | |
| 57 | + { AV_PIX_FMT_YUVA444P, AV_PIX_FMT_YUVA444P10, AV_PIX_FMT_YUVA444P12, 0 ,AV_PIX_FMT_YUVA444P16 }, | |
| 58 | 58 | }; |
| 59 | 59 | |
| 60 | 60 | static APVVLCLUT decode_lut; |
| @@ -75,6 +75,11 @@ static int apv_decode_check_format(AVCodecContext *avctx, · 14 unmodified lines | ||
| 75 | 75 | avctx->pix_fmt = |
| 76 | 76 | apv_format_table[header->frame_info.chroma_format_idc][bit_depth - 4 >> 2]; |
| 77 | 77 | |
| 78 | + if (!avctx->pix_fmt) { | |
| 79 | + avpriv_request_sample(avctx, "YUVA444P14"); | |
| 80 | + return AVERROR_PATCHWELCOME; | |
| 81 | + } | |
| 82 | + | |
| 78 | 83 | err = ff_set_dimensions(avctx, |
| 79 | 84 | FFALIGN(header->frame_info.frame_width, 16), |
| 80 | 85 | FFALIGN(header->frame_info.frame_height, 16)); |