avcodec/parser: Check next index validity in ff_combine_frame()
authorMichael Niedermayer <michael@niedermayer.cc>
Sat, 6 Jul 2019 07:21:52 +0000 (09:21 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Wed, 17 Jul 2019 21:18:50 +0000 (23:18 +0200)
Fixes: out of array access
Fixes: 15522/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DNXHD_fuzzer-5747756078989312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/parser.c

index 0a994a3..3e19810 100644 (file)
@@ -245,6 +245,9 @@ int ff_combine_frame(ParseContext *pc, int next,
     for (; pc->overread > 0; pc->overread--)
         pc->buffer[pc->index++] = pc->buffer[pc->overread_index++];
 
+    if (next > *buf_size)
+        return AVERROR(EINVAL);
+
     /* flush remaining if EOF */
     if (!*buf_size && next == END_NOT_FOUND)
         next = 0;