[FFmpeg-cvslog] avcodec/bgmc: Check input space in ff_bgmc_decode_init()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer <michael at niedermayer.cc> | Sun Sep  1 22:31:45 2019 +0200| [517fd68acd7e7a5472fa3c42d2f833773fbcb5b3] | committer: Michael Niedermayer

avcodec/bgmc: Check input space in ff_bgmc_decode_init()

Fixes: Infinite loop
Fixes: 16608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5636229827133440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann at mail.de>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit b54031a6e93d1abc7fb2d0263e0f6c4b639e423f)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=517fd68acd7e7a5472fa3c42d2f833773fbcb5b3
---

 libavcodec/alsdec.c | 4 +++-
 libavcodec/bgmc.c   | 7 ++++++-
 libavcodec/bgmc.h   | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index 11bbd38f58..f8d10df8c6 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -821,7 +821,9 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
         unsigned int low;
         unsigned int value;
 
-        ff_bgmc_decode_init(gb, &high, &low, &value);
+        int ret = ff_bgmc_decode_init(gb, &high, &low, &value);
+        if (ret < 0)
+            return ret;
 
         current_res = bd->raw_samples + start;
 
diff --git a/libavcodec/bgmc.c b/libavcodec/bgmc.c
index 1a6817b73f..2d59aa37ad 100644
--- a/libavcodec/bgmc.c
+++ b/libavcodec/bgmc.c
@@ -485,12 +485,17 @@ av_cold void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status)
 
 
 /** Initialize decoding and reads the first value */
-void ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
+int ff_bgmc_decode_init(GetBitContext *gb, unsigned int *h,
                          unsigned int *l, unsigned int *v)
 {
+    if (get_bits_left(gb) < VALUE_BITS)
+        return AVERROR_INVALIDDATA;
+
     *h = TOP_VALUE;
     *l = 0;
     *v = get_bits_long(gb, VALUE_BITS);
+
+    return 0;
 }
 
 
diff --git a/libavcodec/bgmc.h b/libavcodec/bgmc.h
index 4893736af5..466df31a2e 100644
--- a/libavcodec/bgmc.h
+++ b/libavcodec/bgmc.h
@@ -40,7 +40,7 @@ int ff_bgmc_init(AVCodecContext *avctx, uint8_t **cf_lut, int **cf_lut_status);
 void ff_bgmc_end(uint8_t **cf_lut, int **cf_lut_status);
 
 
-void ff_bgmc_decode_init(GetBitContext *gb,
+int ff_bgmc_decode_init(GetBitContext *gb,
                       unsigned int *h, unsigned int *l, unsigned int *v);