[FFmpeg-devel] [PR] avcodec/interplayacm: Check input for fill_block() (PR #21727)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21727 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21727
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21727.patch

Fixes: Timeout
Fixes: 476763877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-4515681843609600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From b4e7f2d2eee19906ac57ffe8090c5f5ed76f8356 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 10 Feb 2026 20:47:25 +0100
Subject: [PATCH] avcodec/interplayacm: Check input for fill_block()

Fixes: Timeout
Fixes: 476763877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-4515681843609600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/interplayacm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/interplayacm.c b/libavcodec/interplayacm.c
index 2d940b903b..cd2e6faa67 100644
--- a/libavcodec/interplayacm.c
+++ b/libavcodec/interplayacm.c
@@ -437,6 +437,9 @@ static int fill_block(InterplayACMContext *s)
     unsigned i, ind;
     int ret;
 
+    if (get_bits_left(gb) < s->cols * 5)
+        return AVERROR_INVALIDDATA;
+
     for (i = 0; i < s->cols; i++) {
         ind = get_bits(gb, 5);
         ret = filler_list[ind](s, ind, i);
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org