diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-12 02:17:15 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-11-15 12:25:45 +0100 |
| commit | 1adb5720a2a5bd0ecc74e9df319ce5f019a42fca (patch) | |
| tree | fb993ba5ca0b141f8ece659301cf17d745a90c5f | |
| parent | 0ca85d1326d0c2aae7940a904030dd93e96aa234 (diff) | |
| download | ffmpeg-1adb5720a2a5bd0ecc74e9df319ce5f019a42fca.tar.gz | |
avcodec/hevcdec: Check delta_luma_weight_l0/1
Fixes: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
Fixes: 16041/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5685680656613376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 021f29506b493376d62cdb5b9cb66a6b85e5361f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/hevcdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c index 2412bd0a97..764c2b26f8 100644 --- a/libavcodec/hevcdec.c +++ b/libavcodec/hevcdec.c @@ -181,6 +181,8 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb) for (i = 0; i < s->sh.nb_refs[L0]; i++) { if (luma_weight_l0_flag[i]) { int delta_luma_weight_l0 = get_se_golomb(gb); + if ((int8_t)delta_luma_weight_l0 != delta_luma_weight_l0) + return AVERROR_INVALIDDATA; s->sh.luma_weight_l0[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l0; s->sh.luma_offset_l0[i] = get_se_golomb(gb); } @@ -223,6 +225,8 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb) for (i = 0; i < s->sh.nb_refs[L1]; i++) { if (luma_weight_l1_flag[i]) { int delta_luma_weight_l1 = get_se_golomb(gb); + if ((int8_t)delta_luma_weight_l1 != delta_luma_weight_l1) + return AVERROR_INVALIDDATA; s->sh.luma_weight_l1[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l1; s->sh.luma_offset_l1[i] = get_se_golomb(gb); } |