Fixes: NULL pointer dereference
Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
if (s < LZF_LITERAL_MAX) {
s++;
if (s > *size - len) {
- *size += *size /2;
+ *size += s + *size /2;
ret = av_reallocp(buf, *size);
if (ret < 0)
return ret;
return AVERROR_INVALIDDATA;
if (l > *size - len) {
- *size += *size / 2;
+ *size += l + *size / 2;
ret = av_reallocp(buf, *size);
if (ret < 0)
return ret;