highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()

Browse Source 
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79204a1fc8f1988f7d7e6cae2c3b68f513444d38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-06-15 23:28:25 +02:00
parent ac9d8e7c50
commit 4d7ee3b0ff
1 changed files with 26 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
libavcodec/vc1_block.c
View File

@ -508,13 +508,15 @@ static inline int vc1_coded_block_pred(MpegEncContext * s, int n,
* @param codingset set of VLC to decode data * @param codingset set of VLC to decode data
* @see 8.1.3.4 * @see 8.1.3.4
*/ */
static void vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip, static int vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip,
int *value, int codingset) int *value, int codingset)
{ {
GetBitContext *gb = &v->s.gb; GetBitContext *gb = &v->s.gb;
int index, run, level, lst, sign; int index, run, level, lst, sign;
index = get_vlc2(gb, ff_vc1_ac_coeff_table[codingset].table, AC_VLC_BITS, 3); index = get_vlc2(gb, ff_vc1_ac_coeff_table[codingset].table, AC_VLC_BITS, 3);
if (index < 0)
return index;
if (index != ff_vc1_ac_sizes[codingset] - 1) { if (index != ff_vc1_ac_sizes[codingset] - 1) {
run = vc1_index_decode_table[codingset][index][0]; run = vc1_index_decode_table[codingset][index][0];
level = vc1_index_decode_table[codingset][index][1]; level = vc1_index_decode_table[codingset][index][1];
@ -560,6 +562,8 @@ static void vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip,
*last = lst; *last = lst;
*skip = run; *skip = run;
*value = (level ^ -sign) + sign; *value = (level ^ -sign) + sign;
return 0;
} }
/** Decode intra block in intra frames - should be faster than decode_intra_block /** Decode intra block in intra frames - should be faster than decode_intra_block
@ -639,7 +643,9 @@ static int vc1_decode_i_block(VC1Context *v, int16_t block[64], int n,
zz_table = v->zz_8x8[1]; zz_table = v->zz_8x8[1];
while (!last) { while (!last) {
vc1_decode_ac_coeff(v, &last, &skip, &value, codingset); int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, codingset);
if (ret < 0)
return ret;
i += skip; i += skip;
if (i > 63) if (i > 63)
break; break;
@ -812,7 +818,9 @@ static int vc1_decode_i_block_adv(VC1Context *v, int16_t block[64], int n,
} }
while (!last) { while (!last) {
vc1_decode_ac_coeff(v, &last, &skip, &value, codingset); int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, codingset);
if (ret < 0)
return ret;
i += skip; i += skip;
if (i > 63) if (i > 63)
break; break;
@ -995,7 +1003,9 @@ static int vc1_decode_intra_block(VC1Context *v, int16_t block[64], int n,
int k; int k;
while (!last) { while (!last) {
vc1_decode_ac_coeff(v, &last, &skip, &value, codingset); int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, codingset);
if (ret < 0)
return ret;
i += skip; i += skip;
if (i > 63) if (i > 63)
break; break;
@ -1161,7 +1171,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t block[64], int n,
i = 0; i = 0;
last = 0; last = 0;
while (!last) { while (!last) {
vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2);
if (ret < 0)
return ret;
i += skip; i += skip;
if (i > 63) if (i > 63)
break; break;
@ -1189,7 +1201,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t block[64], int n,
i = 0; i = 0;
off = (j & 1) * 4 + (j & 2) * 16; off = (j & 1) * 4 + (j & 2) * 16;
while (!last) { while (!last) {
vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2);
if (ret < 0)
return ret;
i += skip; i += skip;
if (i > 15) if (i > 15)
break; break;
@ -1216,7 +1230,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t block[64], int n,
i = 0; i = 0;
off = j * 32; off = j * 32;
while (!last) { while (!last) {
vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2);
if (ret < 0)
return ret;
i += skip; i += skip;
if (i > 31) if (i > 31)
break; break;
@ -1243,7 +1259,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t block[64], int n,
i = 0; i = 0;
off = j * 4; off = j * 4;
while (!last) { while (!last) {
vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); int ret = vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2);
if (ret < 0)
return ret;
i += skip; i += skip;
if (i > 31) if (i > 31)
break; break;