From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 9 May 2017 14:08:14 +0000 (+0200)
Subject: avcodec/snowdec: Check width
X-Git-Tag: android-x86-7.1-r1~436
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=78aa93807b3e0674e34d32c0bf6f78d7f5b7927e;p=android-x86%2Fexternal-ffmpeg.git

avcodec/snowdec: Check width

Fixes: out of array read
Fixes: 1419/clusterfuzz-testcase-minimized-6108700873850880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---

diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
index 8c35e3e084..bcb3469062 100644
--- a/libavcodec/snowdec.c
+++ b/libavcodec/snowdec.c
@@ -384,6 +384,10 @@ static int decode_header(SnowContext *s){
         av_log(s->avctx, AV_LOG_ERROR, "spatial_decomposition_count %d too large for size\n", s->spatial_decomposition_count);
         return AVERROR_INVALIDDATA;
     }
+    if (s->avctx->width > 65536-4) {
+        av_log(s->avctx, AV_LOG_ERROR, "Width %d is too large\n", s->avctx->width);
+        return AVERROR_INVALIDDATA;
+    }
 
 
     s->qlog           += get_symbol(&s->c, s->header_state, 1);