Fixes: out of array access
Fixes: 31386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5773234709594112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
if (x == run_sym) {
int run = get_bits(&gbit, 8);
- uint16_t fill = out[oe - 1];
+ uint16_t fill;
+
+ if (oe == 0 || oe + run > no)
+ return AVERROR_INVALIDDATA;
+
+ fill = out[oe - 1];
while (run-- > 0)
out[oe++] = fill;