[FFmpeg-devel] [PR] avcodec/svq1dec: Check input space for minimum (PR #21724)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21724 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21724
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21724.patch

Fixes: Timeout
Fixes: 472769364/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_DEC_fuzzer-5519737145851904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From cd3fce397733abd906dfd7dc642f43fec5445e35 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 10 Feb 2026 18:42:07 +0100
Subject: [PATCH] avcodec/svq1dec: Check input space for minimum

Fixes: Timeout
Fixes: 472769364/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_DEC_fuzzer-5519737145851904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/svq1dec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c
index 5505b896a2..0dd10e5f88 100644
--- a/libavcodec/svq1dec.c
+++ b/libavcodec/svq1dec.c
@@ -696,6 +696,9 @@ static int svq1_decode_frame(AVCodecContext *avctx, AVFrame *cur,
         avctx->skip_frame >= AVDISCARD_ALL)
         return buf_size;
 
+    if (get_bits_left(&s->gb) < FFALIGN(s->width,  16) * FFALIGN(s->height, 16) / 256)
+        return AVERROR_INVALIDDATA;
+
     result = ff_get_buffer(avctx, cur, s->nonref ? 0 : AV_GET_BUFFER_FLAG_REF);
     if (result < 0)
         return result;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org