[FFmpeg-cvslog] avcodec/iff: dont add into unused pointers

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sat Mar 16 20:51:23 2024 +0100| [c0532f5579dcca4ad1d4c8db2068be7554c7cb63] | committer: Michael Niedermayer

avcodec/iff: dont add into unused pointers

Fixes: overflowing pointers
Fixes: 66444/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-4812862400823296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c0532f5579dcca4ad1d4c8db2068be7554c7cb63
---

 libavcodec/iff.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index 133f69350f..4b3e8e0c21 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -1662,7 +1662,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
                     memset(row, 0, avctx->width);
                     for (plane = 0; plane < s->bpp; plane++) {
-                        buf += decode_byterun(s->planebuf, s->planesize, gb);
+                        decode_byterun(s->planebuf, s->planesize, gb);
                         if (avctx->codec_tag == MKTAG('A', 'N', 'I', 'M')) {
                             memcpy(video, s->planebuf, s->planesize);
                             video += s->planesize;
@@ -1675,7 +1675,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
                     memset(s->mask_buf, 0, avctx->width * sizeof(uint32_t));
                     for (plane = 0; plane < s->bpp; plane++) {
-                        buf += decode_byterun(s->planebuf, s->planesize, gb);
+                        decode_byterun(s->planebuf, s->planesize, gb);
                         decodeplane32(s->mask_buf, s->planebuf, s->planesize, plane);
                     }
                     lookup_pal_indicies((uint32_t *)row, s->mask_buf, s->mask_palbuf, avctx->width);
@@ -1686,7 +1686,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
                     memset(s->ham_buf, 0, s->planesize * 8);
                     for (plane = 0; plane < s->bpp; plane++) {
-                        buf += decode_byterun(s->planebuf, s->planesize, gb);
+                        decode_byterun(s->planebuf, s->planesize, gb);
                         if (avctx->codec_tag == MKTAG('A', 'N', 'I', 'M')) {
                             memcpy(video, s->planebuf, s->planesize);
                             video += s->planesize;
@@ -1700,7 +1700,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
                     memset(row, 0, avctx->width << 2);
                     for (plane = 0; plane < s->bpp; plane++) {
-                        buf += decode_byterun(s->planebuf, s->planesize, gb);
+                        decode_byterun(s->planebuf, s->planesize, gb);
                         decodeplane32((uint32_t *)row, s->planebuf, s->planesize, plane);
                     }
                 }
@@ -1709,12 +1709,12 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
             if (avctx->pix_fmt == AV_PIX_FMT_PAL8 || avctx->pix_fmt == AV_PIX_FMT_GRAY8) {
                 for (y = 0; y < avctx->height; y++) {
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
-                    buf += decode_byterun(row, avctx->width, gb);
+                    decode_byterun(row, avctx->width, gb);
                 }
             } else if (s->ham) { // IFF-PBM: HAM to AV_PIX_FMT_BGR32
                 for (y = 0; y < avctx->height; y++) {
                     uint8_t *row = &frame->data[0][y * frame->linesize[0]];
-                    buf += decode_byterun(s->ham_buf, avctx->width, gb);
+                    decode_byterun(s->ham_buf, avctx->width, gb);
                     decode_ham_plane32((uint32_t *)row, s->ham_buf, s->ham_palbuf, s->planesize);
                 }
             } else