avcodec/evc_parse: Check num_remaining_tiles_in_slice_minus1

Fixes: out of array access Fixes: 62467/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-6092990982258688

Michael Niedermayer committed 3 years ago

Commit ac4e3e11 parent bb0a6841 file · +6 −2Browse files

Unified · Split

libavcodec/evc_parse.c+6−2

@@ -58,8 +58,12 @@ int ff_evc_parse_slice_header(GetBitContext gb, EVCParserSliceHeader sh, · 57 unmodified lines
58	58	if (!sh->arbitrary_slice_flag)
59	59	sh->last_tile_id = get_bits(gb, pps->tile_id_len_minus1 + 1);
60	60	else {
61		− sh->num_remaining_tiles_in_slice_minus1 = get_ue_golomb_long(gb);
62		− num_tiles_in_slice = sh->num_remaining_tiles_in_slice_minus1 + 2;
	61	+ unsigned num_remaining_tiles_in_slice_minus1 = get_ue_golomb_long(gb);
	62	+ if (num_remaining_tiles_in_slice_minus1 > EVC_MAX_TILE_ROWS * EVC_MAX_TILE_COLUMNS - 2)
	63	+ return AVERROR_INVALIDDATA;
	64	+
	65	+ num_tiles_in_slice = num_remaining_tiles_in_slice_minus1 + 2;
	66	+ sh->num_remaining_tiles_in_slice_minus1 = num_remaining_tiles_in_slice_minus1;
63	67	for (int i = 0; i < num_tiles_in_slice - 1; ++i)
64	68	sh->delta_tile_id_minus1[i] = get_ue_golomb_long(gb);
65	69	}