[FFmpeg-cvslog] avcodec/lzf: Check for input space

[Michael Niedermayer]

ffmpeg | branch: release/6.1 | Michael Niedermayer <michael at niedermayer.cc> | Sun Aug  3 08:33:40 2025 +0200| [a83631dcb6d2fc34dd3bf0f10aeb66f9afcc3ca6] | committer: Michael Niedermayer

avcodec/lzf: Check for input space

Fixes: use of uninitialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5597015691296768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 610d368d9bc3f1b7073a0b33e352f8bd7db24c7e)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a83631dcb6d2fc34dd3bf0f10aeb66f9afcc3ca6
---

 libavcodec/lzf.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c
index 1e3c86c88c..94b369dd59 100644
--- a/libavcodec/lzf.c
+++ b/libavcodec/lzf.c
@@ -56,7 +56,10 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
                 p = *buf + len;
             }
 
-            bytestream2_get_buffer(gb, p, s);
+            int s2 = bytestream2_get_buffer(gb, p, s);
+            if (s2 != s)
+                return AVERROR_INVALIDDATA;
+
             p   += s;
             len += s;
         } else {