[FFmpeg-cvslog] avcodec/cfhd: Move peak_table() and difference_coding() calls after the existing coefficient count check

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon Aug 13 00:44:48 2018 +0200| [2c1613ac94d07fd85e8831bb7aa7eb4bec707285] | committer: Michael Niedermayer

avcodec/cfhd: Move peak_table() and difference_coding() calls after the existing coefficient count check

Fixes: out of array access
Fixes: 9509/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5283250636324864
Fixes: 9572/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4920757409808384
Fixes: 9596/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5114917580439552
Fixes: 9640/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-6247840698335232
Fixes: 9659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-6079554987753472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2c1613ac94d07fd85e8831bb7aa7eb4bec707285
---

 libavcodec/cfhd.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c
index 76838f0869..1959762f0e 100644
--- a/libavcodec/cfhd.c
+++ b/libavcodec/cfhd.c
@@ -668,11 +668,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
                         for (i = 0; i < run; i++)
                             *coeff_data++ = coeff;
                     }
-                    if (s->peak.level)
-                        peak_table(coeff_data - expected, &s->peak, expected);
-                    if (s->difference_coding)
-                        difference_coding(s->plane[s->channel_num].subband[s->subband_num_actual], highpass_width, highpass_height);
-
                 } else {
                     while (1) {
                         UPDATE_CACHE(re, &s->gb);
@@ -692,11 +687,6 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
                         for (i = 0; i < run; i++)
                             *coeff_data++ = coeff;
                     }
-                    if (s->peak.level)
-                        peak_table(coeff_data - expected, &s->peak, expected);
-                    if (s->difference_coding)
-                        difference_coding(s->plane[s->channel_num].subband[s->subband_num_actual], highpass_width, highpass_height);
-
                 }
                 CLOSE_READER(re, &s->gb);
             }
@@ -706,6 +696,10 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
                 ret = AVERROR(EINVAL);
                 goto end;
             }
+            if (s->peak.level)
+                peak_table(coeff_data - expected, &s->peak, expected);
+            if (s->difference_coding)
+                difference_coding(s->plane[s->channel_num].subband[s->subband_num_actual], highpass_width, highpass_height);
 
             bytes = FFALIGN(AV_CEIL_RSHIFT(get_bits_count(&s->gb), 3), 4);
             if (bytes > bytestream2_get_bytes_left(&gb)) {