Hi James On Fri, Feb 07, 2025 at 01:47:51PM -0300, James Almer wrote: > Fixes ticket #11427 > > Signed-off-by: James Almer <jamr...@gmail.com> > --- > It may be a good idea to ensure the timeout fuzzer case doesn't regress > after this. > > libavcodec/vorbisdec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c > index 218e855f7a..321408723d 100644 > --- a/libavcodec/vorbisdec.c > +++ b/libavcodec/vorbisdec.c > @@ -1470,7 +1470,7 @@ static av_always_inline int > vorbis_residue_decode_internal(vorbis_context *vc, > vorbis_codebook codebook = vc->codebooks[vqbook]; > > if (get_bits_left(gb) <= 0) > - return AVERROR_INVALIDDATA; > + return 0;
This looks suspect For the test sample from #11427 get_bits_left() at this point is -8 that means 8 bits have already been read beyond the buffer. wherever the error is, reading 8 bits beyond is unlikely to be the correct and intended behavior I think the question would be, what created this file and how exactly does libvorbis handle it, does it also read beyond the buffer That is, do we have a encoder or a decoder bug, and what is that bug exactly thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety -- Benjamin Franklin
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
