diff options
| author | Michael Niedermayer <[email protected]> | 2019-06-18 23:55:56 +0200 |
|---|---|---|
| committer | Michael Niedermayer <[email protected]> | 2019-11-14 23:30:37 +0100 |
| commit | ec2b12fa05cbd2aca03cafa723504f9ab7156add (patch) | |
| tree | cbaa998bd66d8d2c06239b37ac3c79e78c9c7d70 | |
| parent | f1400191c600f992c6cbab933a9dba7e3cedccde (diff) | |
avcodec/utils: Check bits_per_coded_sample
This avoids the need for each decoder separately having to handle this case
Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit d33414d2ad27a5d2193c9ab0948ba7a282c2f910)
Signed-off-by: Michael Niedermayer <[email protected]>
| -rw-r--r-- | libavcodec/utils.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/utils.c b/libavcodec/utils.c index ec03bdc866..c587110af2 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -1056,6 +1056,10 @@ FF_ENABLE_DEPRECATION_WARNINGS ret = AVERROR(EINVAL); goto free_and_end; } + if (avctx->bits_per_coded_sample < 0) { + ret = AVERROR(EINVAL); + goto free_and_end; + } if (avctx->sub_charenc) { if (avctx->codec_type != AVMEDIA_TYPE_SUBTITLE) { av_log(avctx, AV_LOG_ERROR, "Character encoding is only " |