highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/lzf: Consider the needed size in reallocation

Browse Source 
Fixes: NULL pointer dereference
Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 292b9b93a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2020-05-28 18:08:57 +02:00
parent e01d07c781
commit c3eaff820a
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/lzf.c
View File

@ -49,7 +49,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
if (s < LZF_LITERAL_MAX) { if (s < LZF_LITERAL_MAX) {
s++; s++;
if (s > *size - len) { if (s > *size - len) {
*size += *size /2; *size += s + *size /2;
ret = av_reallocp(buf, *size); ret = av_reallocp(buf, *size);
if (ret < 0) if (ret < 0)
return ret; return ret;
@ -72,7 +72,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (l > *size - len) { if (l > *size - len) {
*size += *size / 2; *size += l + *size / 2;
ret = av_reallocp(buf, *size); ret = av_reallocp(buf, *size);
if (ret < 0) if (ret < 0)
return ret; return ret;