PR #21727 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21727 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21727.patch
Fixes: Timeout Fixes: 476763877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-4515681843609600 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From b4e7f2d2eee19906ac57ffe8090c5f5ed76f8356 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 10 Feb 2026 20:47:25 +0100 Subject: [PATCH] avcodec/interplayacm: Check input for fill_block() Fixes: Timeout Fixes: 476763877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-4515681843609600 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/interplayacm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/interplayacm.c b/libavcodec/interplayacm.c index 2d940b903b..cd2e6faa67 100644 --- a/libavcodec/interplayacm.c +++ b/libavcodec/interplayacm.c @@ -437,6 +437,9 @@ static int fill_block(InterplayACMContext *s) unsigned i, ind; int ret; + if (get_bits_left(gb) < s->cols * 5) + return AVERROR_INVALIDDATA; + for (i = 0; i < s->cols; i++) { ind = get_bits(gb, 5); ret = filler_list[ind](s, ind, i); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
