Fixes: Segfault
Fixes: 17991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCOM_fuzzer-5647235349479424
Also fixes related memleak
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
s->dict[i].r = AV_RB16(avctx->extradata + 6 + 4 * i + 2);
if (s->dict[i].l >= 0 &&
(s->dict[i].l >= s->dict_entries ||
- s->dict[i].r >= s->dict_entries))
+ s->dict[i].r >= s->dict_entries ||
+ s->dict[i].r < 0 )) {
+ av_freep(&s->dict);
return AVERROR_INVALIDDATA;
+ }
+ }
+ if (s->dict[0].l < 0) {
+ av_freep(&s->dict);
+ return AVERROR_INVALIDDATA;
}
avctx->sample_fmt = AV_SAMPLE_FMT_U8;