diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-21 19:34:31 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-22 03:09:18 +0200 |
| commit | df11b45644e0c3067650b3a926aa8b6fc45cafa6 (patch) | |
| tree | 9f887a3716c86ccf843e653638f973413aa40f25 | |
| parent | 605bc45295e935786b53bb9156440e089f8512d2 (diff) | |
| download | ffmpeg-df11b45644e0c3067650b3a926aa8b6fc45cafa6.tar.gz | |
avcodec/cfhd: Check bpc before setting bpc in context
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 2306/clusterfuzz-testcase-minimized-5002997392211968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f1d2355a7e4d681bea82b4cf4280272d9fe8af3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/cfhd.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 1dc9292421..f596554e1b 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -250,6 +250,11 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, s->coded_height = data; } else if (tag == 101) { av_log(avctx, AV_LOG_DEBUG, "Bits per component: %"PRIu16"\n", data); + if (data < 1 || data > 31) { + av_log(avctx, AV_LOG_ERROR, "Bits per component %d is invalid\n", data); + ret = AVERROR(EINVAL); + break; + } s->bpc = data; } else if (tag == 12) { av_log(avctx, AV_LOG_DEBUG, "Channel Count: %"PRIu16"\n", data); @@ -396,12 +401,12 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, av_log(avctx, AV_LOG_DEBUG, "Other codebook? %i\n", s->codebook); } else if (tag == 70) { av_log(avctx, AV_LOG_DEBUG, "Subsampling or bit-depth flag? %i\n", data); - s->bpc = data; - if (!(s->bpc == 10 || s->bpc == 12)) { + if (!(data == 10 || data == 12)) { av_log(avctx, AV_LOG_ERROR, "Invalid bits per channel\n"); ret = AVERROR(EINVAL); break; } + s->bpc = data; } else if (tag == 84) { av_log(avctx, AV_LOG_DEBUG, "Sample format? %i\n", data); if (data == 1) |