avcodec/takdec: Check remaining space for first predictors

Fixes: Timeout Fixes: 403673829/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5498240154009600

Michael Niedermayer committed 1 year ago

Commit 8e6db871 parent 4a9d9071 file · +3 −0Browse files

Unified · Split

@@ -434,6 +434,9 @@ static int decode_subframe(TAKDecContext s, int32_t decoded, · 433 unmodified lines
434	434	return AVERROR_INVALIDDATA;
435	435	}
436	436
	437	+ if (get_bits_left(gb) < 210 + 2size)
	438	+ return AVERROR_INVALIDDATA;
	439	+
437	440	s->predictors[0] = get_sbits(gb, 10);
438	441	s->predictors[1] = get_sbits(gb, 10);
439	442	s->predictors[2] = get_sbits(gb, size) * (1 << (10 - size));

Keyboard shortcuts