diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-18 23:55:56 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-11-11 20:18:46 +0100 |
| commit | 21e5569d7f901122fbf426e9dcf918c03bb761fb (patch) | |
| tree | 0c7e1578ef44cfd4483332a2c43bc793d145fe1d | |
| parent | 768c8c6852ccbf19de99b485d9af9717a8d5fec8 (diff) | |
| download | ffmpeg-21e5569d7f901122fbf426e9dcf918c03bb761fb.tar.gz | |
avcodec/utils: Check bits_per_coded_sample
This avoids the need for each decoder separately having to handle this case
Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d33414d2ad27a5d2193c9ab0948ba7a282c2f910)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/utils.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/utils.c b/libavcodec/utils.c index 59d41ccbb6..80661a32b0 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -951,6 +951,10 @@ FF_ENABLE_DEPRECATION_WARNINGS ret = AVERROR(EINVAL); goto free_and_end; } + if (avctx->bits_per_coded_sample < 0) { + ret = AVERROR(EINVAL); + goto free_and_end; + } if (avctx->sub_charenc) { if (avctx->codec_type != AVMEDIA_TYPE_SUBTITLE) { av_log(avctx, AV_LOG_ERROR, "Character encoding is only " |