Fixes: out of array read in decode_cu_16x16() Fixes: 398049430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5525836849807360
Unified · Split
| @@ -1791,7 +1791,7 @@ static int decode_cu_r(RV60Context * s, AVFrame * frame, ThreadContext * thread, · 1790 unmodified lines | ||
| 1791 | 1791 | ttype = cu.pu_type == PU_FULL ? TRANSFORM_8X8 : TRANSFORM_4X4; |
| 1792 | 1792 | |
| 1793 | 1793 | is_intra = cu.cu_type == CU_INTRA; |
| 1794 | − if (is_intra && qp >= 32) | |
| 1794 | + if (qp >= 32) | |
| 1795 | 1795 | return AVERROR_INVALIDDATA; |
| 1796 | 1796 | cu_pos = ((xpos & 63) >> 3) + ((ypos & 63) >> 3) * 8; |
| 1797 | 1797 | |