avcodec/eatgq: : Check index increments in tgq_decode_block()

Fixes: out of array access Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-6743211456724992

Michael Niedermayer committed 3 years ago

Commit e7755b41 parent 2378cbe1 file · +11 −3Browse files

Unified · Split

     return 0;
 }
-static void tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb)
+static int tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb)
 {
     const uint8_t *scantable = ff_zigzag_direct;
     int i, j, value;
     for (i = 1; i < 64;) {
         switch (show_bits(gb, 3)) {
         case 4:
+            if (i >= 63)
+                return AVERROR_INVALIDDATA;
             block[scantable[i++]] = 0;
         case 0:
             block[scantable[i++]] = 0;
         case 1:
             skip_bits(gb, 2);
             value = get_bits(gb, 6);
+            if (value > 64 - i)
+                return AVERROR_INVALIDDATA;
             for (j = 0; j < value; j++)
                 block[scantable[i++]] = 0;
             break;
         }
     }
     block[0] += 128 << 4;
+    return 0;
 }
 static void tgq_idct_put_mb(TgqContext *s, int16_t (*block)[64], AVFrame *frame,
         if (ret < 0)
             return ret;
-        for (i = 0; i < 6; i++)
+        for (i = 0; i < 6; i++) {
-            tgq_decode_block(s, s->block[i], &gb);
+            int ret = tgq_decode_block(s, s->block[i], &gb);
+            if (ret < 0)
+                return ret;
+        }
         tgq_idct_put_mb(s, s->block, frame, mb_x, mb_y);
         bytestream2_skip(gbyte, mode);
     } else {

Keyboard shortcuts