[FFmpeg-cvslog] avcodec/svq3: Check there are bits left before decompression

[Michael Niedermayer]

ffmpeg | branch: release/7.0 | Michael Niedermayer <michael at niedermayer.cc> | Sun May 11 01:35:29 2025 +0200| [f2bc7ba82f6a3bda09c4e11dbd8fc4ad522e9b55] | committer: Michael Niedermayer

avcodec/svq3: Check there are bits left before decompression

Fixes: out of array read
Fixes: 402587670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-6343867775647744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit c06f5b3ab97b1b1d0420309201568e38b3920860)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f2bc7ba82f6a3bda09c4e11dbd8fc4ad522e9b55
---

 libavcodec/svq3.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index 8d0e096edc..a90e750655 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -1252,6 +1252,7 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
             uint8_t *buf;
 
             if (watermark_height <= 0 ||
+                get_bits_left(&gb) <= 0 ||
                 (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
                 return AVERROR_INVALIDDATA;