avcodec/motionpixels: Mask pixels to valid values

michaelni · michaelni · commit ff5cce2eafeb · 2023-02-25T22:50:36.000+01:00
Fixes: out of array access Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-6724203352555520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit ac6eec1) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff --git a/libavcodec/motionpixels.c b/libavcodec/motionpixels.c
@@ -185,7 +185,7 @@ static YuvPixel mp_get_yuv_from_rgb(MotionPixelsContext *mp, int x, int y)
     int color;
 
     color = *(uint16_t *)&mp->frame->data[0][y * mp->frame->linesize[0] + x * 2];
-    return mp_rgb_yuv_table[color];
+    return mp_rgb_yuv_table[color & 0x7FFF];
 }
 
 static void mp_set_rgb_from_yuv(MotionPixelsContext *mp, int x, int y, const YuvPixel *p)

Original file line number	Diff line number	Diff line change
`@@ -185,7 +185,7 @@ static YuvPixel mp_get_yuv_from_rgb(MotionPixelsContext *mp, int x, int y)`
`185`	`185`	`int color;`
`186`	`186`
`187`	`187`	`color = (uint16_t )&mp->frame->data[0][y * mp->frame->linesize[0] + x * 2];`
`188`		`- return mp_rgb_yuv_table[color];`
	`188`	`+ return mp_rgb_yuv_table[color & 0x7FFF];`
`189`	`189`	`}`
`190`	`190`
`191`	`191`	`static void mp_set_rgb_from_yuv(MotionPixelsContext mp, int x, int y, const YuvPixel p)`