diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-02-17 21:42:34 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-04-13 00:35:15 +0200 |
| commit | 37cd7f3375302b2c8e35946a53db13a8bd123b8b (patch) | |
| tree | 6c5f60718ccbbb830fee9d0271d6754c559953b4 | |
| parent | 1a4f8de03d57490b6344ec2eeba3aa816cd1eb62 (diff) | |
| download | ffmpeg-37cd7f3375302b2c8e35946a53db13a8bd123b8b.tar.gz | |
avcodec/hevcdec: Check luma/chroma_log2_weight_denom
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'
Fixes: 5888/clusterfuzz-testcase-minimized-5634701067812864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f82dd4c09b2decb033f1e339d4be81efd38554f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/hevcdec.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c index 5579a4df43..db0bebfa49 100644 --- a/libavcodec/hevcdec.c +++ b/libavcodec/hevcdec.c @@ -149,12 +149,18 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb) int luma_log2_weight_denom; luma_log2_weight_denom = get_ue_golomb_long(gb); - if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7) + if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7) { av_log(s->avctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is invalid\n", luma_log2_weight_denom); + return AVERROR_INVALIDDATA; + } s->sh.luma_log2_weight_denom = av_clip_uintp2(luma_log2_weight_denom, 3); if (s->ps.sps->chroma_format_idc != 0) { - int delta = get_se_golomb(gb); - s->sh.chroma_log2_weight_denom = av_clip_uintp2(s->sh.luma_log2_weight_denom + delta, 3); + int64_t chroma_log2_weight_denom = luma_log2_weight_denom + (int64_t)get_se_golomb(gb); + if (chroma_log2_weight_denom < 0 || chroma_log2_weight_denom > 7) { + av_log(s->avctx, AV_LOG_ERROR, "chroma_log2_weight_denom %"PRId64" is invalid\n", chroma_log2_weight_denom); + return AVERROR_INVALIDDATA; + } + s->sh.chroma_log2_weight_denom = chroma_log2_weight_denom; } for (i = 0; i < s->sh.nb_refs[L0]; i++) { |