shithub: dav1d

Info  •  Files  •  Log  •  Branches

tile: check for arithmetic underflow in tile setup

Fixes a fuzzing crash in crash-5f55445c56a36f28259bc742dd08b2c5ba42045d.

--- a/src/decode.c

+++ b/src/decode.c

@@ -2513,6 +2513,7 @@

             if (j == f->tile[i].end - empty_tiles) {

                 tile_sz = size;

             } else {

+                if (f->frame_hdr.tiling.n_bytes > size) goto error;

                 tile_sz = 0;

                 for (int k = 0; k < f->frame_hdr.tiling.n_bytes; k++)

                     tile_sz |= *data++ << (k * 8);