avcodec/cri: Check bytestream2_get_buffer() for end

Fixes: use of uninintialized memory Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5910856640823296

Michael Niedermayer committed 1 year ago

Commit ea3851b1 parent d9bf3c11 file · +2 −1Browse files

Unified · Split

@@ -220,7 +220,8 @@ static int cri_decode_frame(AVCodecContext avctx, AVFrame p, · 219 unmodified lines
220	220	break;
221	221	case 102:;
222	222	int read_len = FFMIN(length, sizeof(codec_name) - 1);
223		− bytestream2_get_buffer(gb, codec_name, read_len))
	223	+ if (read_len != bytestream2_get_buffer(gb, codec_name, read_len))
	224	+ return AVERROR_INVALIDDATA;
224	225	length -= read_len;
225	226	if (strncmp(codec_name, "cintel_craw", read_len))
226	227	return AVERROR_INVALIDDATA;

Keyboard shortcuts