Fixes: out of array access Fixes: 55597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4898293416329216
Unified · Split
| @@ -475,6 +475,11 @@ static int read_extra_header(FFV1Context *f) · 474 unmodified lines | ||
| 475 | 475 | return AVERROR_INVALIDDATA; |
| 476 | 476 | } |
| 477 | 477 | |
| 478 | + if (f->num_h_slices > MAX_SLICES / f->num_v_slices) { | |
| 479 | + av_log(f->avctx, AV_LOG_ERROR, "slice count unsupported\n"); | |
| 480 | + return AVERROR_PATCHWELCOME; | |
| 481 | + } | |
| 482 | + | |
| 478 | 483 | f->quant_table_count = get_symbol(c, state, 0); |
| 479 | 484 | if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count) { |
| 480 | 485 | av_log(f->avctx, AV_LOG_ERROR, "quant table count %d is invalid\n", f->quant_table_count); |