[FFmpeg-cvslog] avcodec/rscc: Check input size for raw mode

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sat Nov 14 17:59:56 2015 +0100| [ac6ab77741f5e57c8c1d3980bfaf3690eb1cd8c0] | committer: Michael Niedermayer

avcodec/rscc: Check input size for raw mode

Fixes out of array read
Fixes: 7fcd09eadd046e326d8ea0af66f166c8/asan_heap-oob_4a52e5_2273_fa6078a10dd575df266fb1e0b4114cd5.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ac6ab77741f5e57c8c1d3980bfaf3690eb1cd8c0
---

 libavcodec/rscc.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c
index 9e7887d..a5bb7d3 100644
--- a/libavcodec/rscc.c
+++ b/libavcodec/rscc.c
@@ -221,6 +221,11 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data,
 
     /* Get pixels buffer, it may be deflated or just raw */
     if (pixel_size == packed_size) {
+        if (bytestream2_get_bytes_left(gbc) < pixel_size) {
+            av_log(avctx, AV_LOG_ERROR, "Insufficient input for %d\n", pixel_size);
+            ret = AVERROR_INVALIDDATA;
+            goto end;
+        }
         pixels = gbc->buffer;
     } else {
         uLongf len = ctx->inflated_size;