Fixes: out of array access Fixes: 62467/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-6092990982258688
Unified · Split
| @@ -58,8 +58,12 @@ int ff_evc_parse_slice_header(GetBitContext *gb, EVCParserSliceHeader *sh, · 57 unmodified lines | |||
| 58 | if (!sh->arbitrary_slice_flag) | 58 | if (!sh->arbitrary_slice_flag) |
| 59 | sh->last_tile_id = get_bits(gb, pps->tile_id_len_minus1 + 1); | 59 | sh->last_tile_id = get_bits(gb, pps->tile_id_len_minus1 + 1); |
| 60 | else { | 60 | else { |
| 61 | sh->num_remaining_tiles_in_slice_minus1 = get_ue_golomb_long(gb); | 61 | unsigned num_remaining_tiles_in_slice_minus1 = get_ue_golomb_long(gb); |
| 62 | num_tiles_in_slice = sh->num_remaining_tiles_in_slice_minus1 + 2; | 62 | if (num_remaining_tiles_in_slice_minus1 > EVC_MAX_TILE_ROWS * EVC_MAX_TILE_COLUMNS - 2) |
| 63 | return AVERROR_INVALIDDATA; | ||
| 64 | |||
| 65 | num_tiles_in_slice = num_remaining_tiles_in_slice_minus1 + 2; | ||
| 66 | sh->num_remaining_tiles_in_slice_minus1 = num_remaining_tiles_in_slice_minus1; | ||
| 63 | for (int i = 0; i < num_tiles_in_slice - 1; ++i) | 67 | for (int i = 0; i < num_tiles_in_slice - 1; ++i) |
| 64 | sh->delta_tile_id_minus1[i] = get_ue_golomb_long(gb); | 68 | sh->delta_tile_id_minus1[i] = get_ue_golomb_long(gb); |
| 65 | } | 69 | } |