diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-21 19:34:31 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-22 01:54:40 +0200 |
| commit | 6f1d2355a7e4d681bea82b4cf4280272d9fe8af3 (patch) | |
| tree | e123b6ea3571b563056cea5006b1640b2a4db314 | |
| parent | 5a950f4e32a9756391f81987246d96b6549dd447 (diff) | |
| download | ffmpeg-6f1d2355a7e4d681bea82b4cf4280272d9fe8af3.tar.gz | |
avcodec/cfhd: Check bpc before setting bpc in context
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 2306/clusterfuzz-testcase-minimized-5002997392211968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/cfhd.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 2a53a23c2b..16fbdb0b78 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -258,6 +258,11 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, s->coded_height = data; } else if (tag == 101) { av_log(avctx, AV_LOG_DEBUG, "Bits per component: %"PRIu16"\n", data); + if (data < 1 || data > 31) { + av_log(avctx, AV_LOG_ERROR, "Bits per component %d is invalid\n", data); + ret = AVERROR(EINVAL); + break; + } s->bpc = data; } else if (tag == 12) { av_log(avctx, AV_LOG_DEBUG, "Channel Count: %"PRIu16"\n", data); @@ -404,12 +409,12 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, av_log(avctx, AV_LOG_DEBUG, "Other codebook? %i\n", s->codebook); } else if (tag == 70) { av_log(avctx, AV_LOG_DEBUG, "Subsampling or bit-depth flag? %i\n", data); - s->bpc = data; - if (!(s->bpc == 10 || s->bpc == 12)) { + if (!(data == 10 || data == 12)) { av_log(avctx, AV_LOG_ERROR, "Invalid bits per channel\n"); ret = AVERROR(EINVAL); break; } + s->bpc = data; } else if (tag == 84) { av_log(avctx, AV_LOG_DEBUG, "Sample format? %i\n", data); if (data == 1) |