highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
81,198 Commits 36 Branches 392 Tags
1e5d151417a6150f657887a9a841eba1ff860875
Commit Graph

81198 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
11c2a96c23 avcodec/h264_cabac: runtime error: signed integer overflow: 2147483647 + 14 cannot be represented in type 'int' 
Fixes: 614/clusterfuzz-testcase-4931860079575040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 258763ad0e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:22 +02:00
Michael Niedermayer
535c1411d7 avcodec/mpeg4videodec: Fix runtime error: shift exponent -2 is negative 
Fixes: 612/clusterfuzz-testcase-4707817137111040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa2b75263e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:22 +02:00
Michael Niedermayer
f03df423ab avcodec/mjpegdec: Fix runtime error: left shift of negative value -507 
Fixes: 611/clusterfuzz-testcase-5613455820193792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c91bdd4524)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:22 +02:00
Michael Niedermayer
e82cddfd05 avcodec/eac3dec: Fix runtime error: left shift of negative value 
Fixes: 610/clusterfuzz-testcase-4831030085156864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 067485b673)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:22 +02:00
Michael Niedermayer
77ffc7596c avcodec/htmlsubtitles: Fix reading one byte beyond the array 
Fixes: fuzz-2-ffmpeg_SUBTITLE_AV_CODEC_ID_SUBRIP_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 04bd1b38ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:22 +02:00
Michael Niedermayer
8c36b7ab36 avcodec/vp6: clear dimensions on failed resolution change in vp6_parse_header() 
Fixes: 807/clusterfuzz-testcase-6470061042696192
Fixes null pointer dereference

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 967feea5eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:22 +02:00
Michael Niedermayer
b8814515c6 avcodec/vp56: Reset have_undamaged_frame on resolution changes 
Fixes: timeout in 758/clusterfuzz-testcase-4720832028868608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e913f2129)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:22 +02:00
Thomas Guilbert
4c66ead5b7 avcodec/vp8: Fix hang with slice threads 
Fixes: 447860.webm

Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9bbc73ae9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:22 +02:00
Michael Niedermayer
e365921419 avcodec/vp8: Check for the bitstream end per MB in decode_mb_row_no_filter() 
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 2 of 2)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1afd246960)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:22 +02:00
Michael Niedermayer
7ba15a6315 avcodec/vp568: Check that there is enough data for ff_vp56_init_range_decoder() 
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 1 of 2)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55d7371fe0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
b6cbbd2273 avcodec/vp8: remove redundant check 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5098a6f627)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
1744437969 avcodec/vp56: Require a correctly decoded frame before using vp56_conceal_mb() 
Fixes timeout with 700/clusterfuzz-testcase-5660909504561152
Fixes timeout with 702/clusterfuzz-testcase-4553541576294400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ce4f28431)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
a7e924324e avcodec/vp3: Do not return random positive values but the buf size 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8094a303b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
e587594741 avcodec/vp8: Check for bitsteam end in decode_mb_row_no_filter() 
Fixes timeout with 686/clusterfuzz-testcase-5853946876788736

this shortcuts (i.e. speeds up) the error and
return-to-user when decoding a truncated frame

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Previous version reviewed by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

(cherry picked from commit 7b5ff7d573)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
0db93a9d40 avcodec/vp56: Factorize vp56_render_mb() out 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c0139463c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
aff4b91b8d avcodec/vp3dsp: Fix multiple signed integer overflow: 46341 * 47523 cannot be represented in type 'int' 
Fixes: 664/clusterfuzz-testcase-4917047475568640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b8b7921c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
2015c109ac Add CHECK/SUINT code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4614bf2caf)
(cherry picked from commit e8d4eacc07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3f2a09a43f6fade53227804459e6babb1c7248b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
38c7a1ef5c avcodec/mpeg12dec: Fix runtime error: left shift of negative value -1 
Fixes: 764/clusterfuzz-testcase-6273034652483584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a720b854b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
b541a79c99 avcodec/vp56: Clear dimensions in case of failure in the middle of a resolution change 
Similar code is used elsewhere in vp56 to force a more complete reinit in the future.
Fixes null pointer dereference
Fixes: 707/clusterfuzz-testcase-4717453097566208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4bed066377)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
eca3cfe9c4 avcodec/vp56: Implement very basic error concealment 
This should fix the fate failure due to a truncated last frame.
Alternatively the frame could be dropped.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d34bf886e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
fccbd911fb avcodec/amrwbdec: Fix 2 runtime errors: left shift of negative value -1 
Fixes: 669/clusterfuzz-testcase-4847965409640448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6bd79ba59f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
eee75451e1 avcodec/pngdec: Fix runtime error: left shift of 152 by 24 places cannot be represented in type 'int' 
Fixes: 666/clusterfuzz-testcase-6581447227867136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 310d2af319)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
c0b9d22390 avcodec/vp56: Fix sign typo 
Fixes: 664/clusterfuzz-testcase-4917047475568640

The change to fate is due to a truncated last frames which is now detected as damaged.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 513a349439)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
751f3f4f5a avcodec/mpegaudiodec_template: Correct return code on id3 tag discarding 
Fixes: 665/clusterfuzz-testcase-4863789881098240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5d81616be3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
aa5e396d42 avcodec/rv34: Simplify and factor get_slice_offset() code 
This also fixes several integer overflows by checking each value before
use.
Fixes: 662/clusterfuzz-testcase-4898131432964096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8696f25444)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
5fcb98f34f avcodec/pictordec: Do not read more than nb_planes 
Fixes undefined behavior
Fixes: 622/clusterfuzz-testcase-5745722022428672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01d196a67d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
ad2f9874b5 avcodec/srtdec: Fix signed integer overflow: 1811992524 * 384 cannot be represented in type 'int' 
Fixes: 617/clusterfuzz-testcase-6413875723370496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c11d3634b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
6549420451 avcodec/pngdec: Check bit depth for validity 
Fixes: runtime error: shift exponent 132 is too large for 32-bit type 'int'
Fixes: 609/clusterfuzz-testcase-4825202619842560

See 11.2.2 IHDR Image header

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4279613a26)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
eb322e44ea avcodec/mpeg12dec: Fix runtime error: left shift of negative value 
Fixes: 608/clusterfuzz-testcase-603978286392934

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 706757d26d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
a6b5e670f4 avcodec/wavpacl: Fix runtime error: left shift of negative value -1 
Fixes: 607/clusterfuzz-testcase-5108792465293312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12eebb845a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Michael Niedermayer
3364c8c53a avformat/http: Check for truncated buffers in http_connect() 
Reported-by: SleepProgger <security@gnutp.com>
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8fa18e042a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Matt Wolenetz
5cd2fcd0a7 lavf/mov.c: Avoid heap allocation wraps in mov_read_{senc,saiz}() 
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643952 (senc,saiz portions)

Signed-off-by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36aba43bd5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
Matt Wolenetz
0abc88f0fd lavf/mov.c: Avoid OOB in mov_read_udta_string() 
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643952 (udta_string portion)

Signed-off-by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9bbdf5d921)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-16 16:00:21 +02:00
James Almer
b014fa21d4 avformat/apng: fix setting frame delay when max_fps is set to no limit 
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 874eb012f7)
 2017-03-21 20:21:53 -03:00
James Almer
8e4abfbb9d swresample/resample: free existing ResampleContext on reinit 
Fixes memleak.

Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit db7a05dab0)
 2017-03-21 12:14:28 -03:00
James Almer
f9083dec0c swresample/resample: move resample_free() higher in the file 
Also make it more readable while at it.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 2a8a8a2e98)
 2017-03-21 12:14:25 -03:00
Rostislav Pehlivanov
e1ed2291ec lavfi/buffersrc: fix directly setting channel layout 
When setting the channel layout directly using AVBufferSrcParameters
the channel layout was correctly set however the init function still
expected the old string format to set the number of channels (when it
hadn't already been specified).

Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
(cherry picked from commit 42959044ac)
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
 2017-02-21 19:02:05 +00:00
Carl Eugen Hoyos
007cf1786c lavf/mpeg: Initialize a stack variable used by memcmp(). 
Silence a valgrind warning.

Fixes ticket #6160.
(cherry picked from commit a5c1c7a8b3)
 2017-02-21 02:16:18 +01:00
Carl Eugen Hoyos
401a3ae2cb lavc/avpacket: Initialize a variable in error path. 
Fixes ticket #6153.

Tested-by: Tyson Smith
(cherry picked from commit 1d54be2153)
 2017-02-17 10:44:32 +01:00
Michael Niedermayer
384d90f268 Update for 3.1.7 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
n3.1.7 		2017-02-08 21:00:39 +01:00
Michael Niedermayer
d20200d303 avcodec/h264_slice: Clear ref_counts on redundant slices 
Fixes reading freed memory
Fixes: 568/clusterfuzz-testcase-6107186067406848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c03029a835)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 20:32:01 +01:00
Matt Wolenetz
02a5e88ebc lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid 
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643951

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Check value reduced as the code does not support values beyond INT_MAX
Also the check is moved to a more common place and before integer truncation

(cherry picked from commit 2d453188c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 20:32:01 +01:00
Matt Wolenetz
b6efd022b7 lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr 
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643950

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Check value reduced as the code does not support larger lengths

(cherry picked from commit fd30e4d57f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 20:32:01 +01:00
Michael Niedermayer
68e9caf16f avcodec/pictordec: Fix logic error 
Fixes: 559/clusterfuzz-testcase-6424225917173760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c2ea3030a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 20:32:01 +01:00
Michael Niedermayer
e34cbd1d2b ffserver_config: Setup codecpar in add_codec() 
fixes segfault in the status page code

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 472fee91bc)
 2017-02-08 20:32:01 +01:00
Michael Niedermayer
6c1a2e6bc3 avcodec/movtextdec: Fix decode_styl() cleanup 
Fixes: null pointer dereference
Fixes: 555/clusterfuzz-testcase-5986646595993600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e248522d1b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 20:32:01 +01:00
Chris Cunningham
a4fb905a14 lavf/matroskadec: fix is_keyframe for early Blocks 
Blocks are marked as key frames whenever the "reference" field is
zero. This breaks for non-keyframe Blocks with a reference timestamp
of zero.

The likelihood of reference timestamp being zero is increased by a
longstanding bug in muxing that encodes reference timestamp as the
absolute time of the referenced frame (rather than relative to the
current Block timestamp, as described in MKV spec).

Now using INT64_MIN to denote "no reference".

Reported to chromium at http://crbug.com/497889 (contains sample)

(cherry picked from commit ac25840ee3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 20:32:01 +01:00
James Almer
ff7a4df8ac configure: bump year 
Happy new year!

(cherry picked from commit d800d48fc6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 20:32:01 +01:00
Michael Niedermayer
9115acb326 avcodec/pngdec: Check trns more completely 
Fixes out of array access
Fixes: 546/clusterfuzz-testcase-4809433909559296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e477f09d0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 20:32:01 +01:00
Michael Niedermayer
1f35ea813d avcodec/interplayvideo: Move parameter change check up 
Fixes out of array read
Fixes: 544/clusterfuzz-testcase-5936536407244800.f8bd9b24_8ba77916_70c2c7be_3df6a2ea_96cd9f14

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1e2192007)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 20:32:01 +01:00