Commit 1a05e6ce authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/dvdsubdec: Sanity check len in decode_rle()

Fixes: Timeout
Fixes: 9778/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5186007132536832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7b023e1)
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 5a4234de
......@@ -124,6 +124,8 @@ static int decode_rle(uint8_t *bitmap, int linesize, int w, int h,
len = decode_run_8bit(&gb, &color);
else
len = decode_run_2bit(&gb, &color);
if (len != INT_MAX && len > w - x)
return AVERROR_INVALIDDATA;
len = FFMIN(len, w - x);
memset(d + x, color, len);
x += len;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment