[FFmpeg-cvslog] avcodec/snowenc: MV limits due to mv_penalty table size

[Michael Niedermayer]

ffmpeg | branch: release/4.3 | Michael Niedermayer <michael at niedermayer.cc> | Tue Jun 18 15:48:23 2024 +0200| [4c539a8162b9b7541bc06fb12904b0f565e7979f] | committer: Michael Niedermayer

avcodec/snowenc: MV limits due to mv_penalty table size

Fixes: out of array read
Fixes: 69673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5476592894148608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 3a9292aff320d7b5048b371b1babea2f9b3c4e69)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4c539a8162b9b7541bc06fb12904b0f565e7979f
---

 libavcodec/snowenc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavcodec/snowenc.c b/libavcodec/snowenc.c
index 8e16fbc9a9..d74a570544 100644
--- a/libavcodec/snowenc.c
+++ b/libavcodec/snowenc.c
@@ -269,6 +269,7 @@ static int encode_q_branch(SnowContext *s, int level, int x, int y){
     int my_context= av_log2(2*FFABS(left->my - top->my));
     int s_context= 2*left->level + 2*top->level + tl->level + tr->level;
     int ref, best_ref, ref_score, ref_mx, ref_my;
+    int range = MAX_MV >> (1 + qpel);
 
     av_assert0(sizeof(s->block_state) >= 256);
     if(s->keyframe){
@@ -310,6 +311,11 @@ static int encode_q_branch(SnowContext *s, int level, int x, int y){
     c->xmax = - (x+1)*block_w + (w<<(LOG2_MB_SIZE - s->block_max_depth)) + 16-3;
     c->ymax = - (y+1)*block_w + (h<<(LOG2_MB_SIZE - s->block_max_depth)) + 16-3;
 
+    c->xmin = FFMAX(c->xmin,-range);
+    c->xmax = FFMIN(c->xmax, range);
+    c->ymin = FFMAX(c->ymin,-range);
+    c->ymax = FFMIN(c->ymax, range);
+
     if(P_LEFT[0]     > (c->xmax<<shift)) P_LEFT[0]    = (c->xmax<<shift);
     if(P_LEFT[1]     > (c->ymax<<shift)) P_LEFT[1]    = (c->ymax<<shift);
     if(P_TOP[0]      > (c->xmax<<shift)) P_TOP[0]     = (c->xmax<<shift);