[FFmpeg-devel] [PATCH 8/8] avcodec/vvc/ctu: Check ff_vvc_num_signalled_palette_entries

[Michael Niedermayer]

Fixes: index 107 out of bounds for type 'uint16_t const[63]'
Fixes: 421336912/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-6436225806565376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/vvc/ctu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
index 7fa2b496389..cf7edccb8b8 100644
--- a/libavcodec/vvc/ctu.c
+++ b/libavcodec/vvc/ctu.c
@@ -1889,7 +1889,7 @@ static int palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
     const int size            = nb_predicted + nb_signaled;
     const bool dual_tree_luma = local_dual_tree && cu->tree_type == DUAL_TREE_LUMA;
 
-    if (size > max_entries)
+    if (size > max_entries || nb_signaled < 0)
         return AVERROR_INVALIDDATA;
 
     for (int c = start; c < end; c++) {
-- 
2.49.0