[FFmpeg-cvslog] avcodec/sga: Check for array end in lzss_decompress()

[Michael Niedermayer]

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael at niedermayer.cc> | Wed Mar 17 22:19:33 2021 +0100| [5d1e309e673f57c0dceb3425f4158d4ca139496b] | committer: Michael Niedermayer

avcodec/sga: Check for array end in lzss_decompress()

Fixes: out of array access
Fixes: 31640/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGA_fuzzer-5630883286614016
Fixes: 31619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGA_fuzzer-5176667708456960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit e8bd34fe4fc05700b19c3915ff9768c8072309c4)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5d1e309e673f57c0dceb3425f4158d4ca139496b
---

 libavcodec/sga.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/sga.c b/libavcodec/sga.c
index 00752a5843..7e6bea530c 100644
--- a/libavcodec/sga.c
+++ b/libavcodec/sga.c
@@ -232,7 +232,7 @@ static int lzss_decompress(AVCodecContext *avctx,
 
                 if (offset <= 0)
                     offset = 1;
-                if (oi < offset)
+                if (oi < offset || oi + count * 2 > dst_size)
                     return AVERROR_INVALIDDATA;
                 for (int j = 0; j < count * 2; j++) {
                     dst[oi] = dst[oi - offset];