Fixes: out of array read in decode_cu_16x16() Fixes: 398049430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5525836849807360
Unified · Split
| @@ -1791,7 +1791,7 @@ static int decode_cu_r(RV60Context * s, AVFrame * frame, ThreadContext * thread, · 1790 unmodified lines | |||
| 1791 | ttype = cu.pu_type == PU_FULL ? TRANSFORM_8X8 : TRANSFORM_4X4; | 1791 | ttype = cu.pu_type == PU_FULL ? TRANSFORM_8X8 : TRANSFORM_4X4; |
| 1792 | 1792 | ||
| 1793 | is_intra = cu.cu_type == CU_INTRA; | 1793 | is_intra = cu.cu_type == CU_INTRA; |
| 1794 | if (is_intra && qp >= 32) | 1794 | if (qp >= 32) |
| 1795 | return AVERROR_INVALIDDATA; | 1795 | return AVERROR_INVALIDDATA; |
| 1796 | cu_pos = ((xpos & 63) >> 3) + ((ypos & 63) >> 3) * 8; | 1796 | cu_pos = ((xpos & 63) >> 3) + ((ypos & 63) >> 3) * 8; |
| 1797 | 1797 | ||