[FFmpeg-devel] [PATCH 1/2] avcodec/ffv1enc_template: Fix remaining space check

[Michael Niedermayer]

Fixes: Assertion sc->slice_coding_mode == 0 failed at libavcodec/ffv1enc.c:1667
Fixes: 408838118/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-6493138204295168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/ffv1enc_template.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/libavcodec/ffv1enc_template.c b/libavcodec/ffv1enc_template.c
index 64f3c420c51..aaf82159eef 100644
--- a/libavcodec/ffv1enc_template.c
+++ b/libavcodec/ffv1enc_template.c
@@ -38,19 +38,13 @@ RENAME(encode_line)(FFV1Context *f, FFV1SliceContext *sc,
     if (bits == 0)
         return 0;
 
-    if (ac != AC_GOLOMB_RICE) {
-        if (c->bytestream_end - c->bytestream < w * 35) {
+    if (sc->slice_coding_mode == 1) {
+        av_assert0(ac != AC_GOLOMB_RICE);
+        if (c->bytestream_end - c->bytestream < (w * bits + 7LL)>>3) {
             av_log(logctx, AV_LOG_ERROR, "encoded Range Coder frame too large\n");
             return AVERROR_INVALIDDATA;
         }
-    } else {
-        if (put_bytes_left(&sc->pb, 0) < w * 4) {
-            av_log(logctx, AV_LOG_ERROR, "encoded Golomb Rice frame too large\n");
-            return AVERROR_INVALIDDATA;
-        }
-    }
 
-    if (sc->slice_coding_mode == 1) {
         for (x = 0; x < w; x++) {
             int i;
             int v = sample[0][x];
@@ -62,6 +56,18 @@ RENAME(encode_line)(FFV1Context *f, FFV1SliceContext *sc,
         return 0;
     }
 
+    if (ac != AC_GOLOMB_RICE) {
+        if (c->bytestream_end - c->bytestream < w * 35) {
+            av_log(logctx, AV_LOG_ERROR, "encoded Range Coder frame too large\n");
+            return AVERROR_INVALIDDATA;
+        }
+    } else {
+        if (put_bytes_left(&sc->pb, 0) < w * 4) {
+            av_log(logctx, AV_LOG_ERROR, "encoded Golomb Rice frame too large\n");
+            return AVERROR_INVALIDDATA;
+        }
+    }
+
     for (x = 0; x < w; x++) {
         int diff, context;
 
-- 
2.49.0