diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-19 19:21:41 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-23 23:21:14 +0200 |
| commit | 419eee63565f81aca67b29582297841c59deaab8 (patch) | |
| tree | 11d80a418736cd744b1371aa5b8bbda8b0cfe22e | |
| parent | 6194cb87cb81ef97adfa2690e489f473182eaffe (diff) | |
| download | ffmpeg-419eee63565f81aca67b29582297841c59deaab8.tar.gz | |
avcodec/proresdec: Consider negative bits left
Fixes: 70036/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_fuzzer-6298797647396864
Fixes: shift exponent 40 is too large for 32-bit type 'uint32_t' (aka 'unsigned int')
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/proresdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/proresdec.c b/libavcodec/proresdec.c index ec1d0bd0be..6a256107b4 100644 --- a/libavcodec/proresdec.c +++ b/libavcodec/proresdec.c @@ -511,7 +511,7 @@ static av_always_inline int decode_ac_coeffs(AVCodecContext *avctx, GetBitContex for (pos = block_mask;;) { bits_left = gb->size_in_bits - re_index; - if (!bits_left || (bits_left < 32 && !SHOW_UBITS(re, gb, bits_left))) + if (bits_left <= 0 || (bits_left < 32 && !SHOW_UBITS(re, gb, bits_left))) break; DECODE_CODEWORD(run, run_to_cb[FFMIN(run, 15)], LAST_SKIP_BITS); |