diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-07-15 22:22:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-07-19 04:03:11 +0200 |
| commit | 1b1abf077d642fe38c2fd133cf18c99d4d7141b4 (patch) | |
| tree | a204d3d2b105309816630361db9743357c57ca57 | |
| parent | a84ed3d01137ecfb31d3283f1a8bc9673468f188 (diff) | |
| download | ffmpeg-1b1abf077d642fe38c2fd133cf18c99d4d7141b4.tar.gz | |
avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2886142e0c3b5f4304c6e2a2bd282770a8a47f93)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/aacdec_template.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c index 2920d06ece..1b119f7c66 100644 --- a/libavcodec/aacdec_template.c +++ b/libavcodec/aacdec_template.c @@ -2161,6 +2161,10 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che) cge = coup->coupling_point == AFTER_IMDCT ? 1 : get_bits1(gb); gain = cge ? get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60: 0; gain_cache = GET_GAIN(scale, gain); +#if USE_FIXED + if ((abs(gain_cache)-1024) >> 3 > 30) + return AVERROR(ERANGE); +#endif } if (coup->coupling_point == AFTER_IMDCT) { coup->gain[c][0] = gain_cache; @@ -2178,6 +2182,10 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che) t >>= 1; } gain_cache = GET_GAIN(scale, t) * s; +#if USE_FIXED + if ((abs(gain_cache)-1024) >> 3 > 30) + return AVERROR(ERANGE); +#endif } } coup->gain[c][idx] = gain_cache; |