avcodec/exr: Check input space before reverse_lut()

Fixes: use of uninitialized memory Fixes: 490707906/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6310933506097152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-03-13 00:51:14 +01:00
parent dfc5d176c9
commit 70286d59f1
1 changed files with 3 additions and 0 deletions
@@ -637,6 +637,9 @@ static int piz_uncompress(const EXRContext *s, const uint8_t *src, int ssize,
                               max_non_zero - min_non_zero + 1);
    memset(td->bitmap + max_non_zero + 1, 0, BITMAP_SIZE - max_non_zero - 1);

+    if (bytestream2_get_bytes_left(&gb) < 4)
+        return AVERROR_INVALIDDATA;
+
    maxval = reverse_lut(td->bitmap, td->lut);

    bytestream2_skip(&gb, 4);