diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-18 23:55:56 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-26 21:41:53 +0200 |
| commit | d33414d2ad27a5d2193c9ab0948ba7a282c2f910 (patch) | |
| tree | 351517af9bae0bb0e3531a736236808b226cc15c | |
| parent | 247a1de7f7d9c5628cf188e677d10ce9e12bd2f2 (diff) | |
| download | ffmpeg-d33414d2ad27a5d2193c9ab0948ba7a282c2f910.tar.gz | |
avcodec/utils: Check bits_per_coded_sample
This avoids the need for each decoder separately having to handle this case
Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/utils.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/utils.c b/libavcodec/utils.c index cc04b73471..1b1feca38c 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -962,6 +962,10 @@ FF_ENABLE_DEPRECATION_WARNINGS ret = AVERROR(EINVAL); goto free_and_end; } + if (avctx->bits_per_coded_sample < 0) { + ret = AVERROR(EINVAL); + goto free_and_end; + } if (avctx->sub_charenc) { if (avctx->codec_type != AVMEDIA_TYPE_SUBTITLE) { av_log(avctx, AV_LOG_ERROR, "Character encoding is only " |