avcodec/svq1dec: Check that there is data left after the header

Fixes: Timeout (21sec -> 255ms)
Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c
index b09abc20bf5cab88888b0ea8193813571cff7bec..25bd3d0253da17eb2f69882a4a68be91b4a23c46 100644 (file)
--- a/libavcodec/svq1dec.c
+++ b/libavcodec/svq1dec.c
@@ -602,6 +602,8 @@ static int svq1_decode_frame_header(AVCodecContext *avctx, AVFrame *frame)
         if (skip_1stop_8data_bits(bitbuf) < 0)
             return AVERROR_INVALIDDATA;
     }
+    if (get_bits_left(bitbuf) <= 0)
+        return AVERROR_INVALIDDATA;
 
     s->width  = width;
     s->height = height;