shithub: dav1d

Info  •  Files  •  Log  •  Branches

getbits: do not call get_bits(0) for coded value 0 in dav1d_get_vlc

Fixes clusterfuzz-testcase-minimized-dav1d_fuzzer-5669943870226432. Credits to
oss-fuzz.

--- a/src/getbits.c

+++ b/src/getbits.c

@@ -95,7 +95,7 @@

     while (!dav1d_get_bits(c, 1))

         if (++n_bits == 32)

             return 0xFFFFFFFFU;

-    return ((1 << n_bits) - 1) + dav1d_get_bits(c, n_bits);

+    return n_bits ? ((1 << n_bits) - 1) + dav1d_get_bits(c, n_bits) : 0;

 }

 static unsigned get_bits_subexp_u(GetBits *const c, const unsigned ref,