diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-08-07 00:19:09 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-08-23 22:52:26 +0200 |
| commit | 1a81a40de265df6c5e4e6bb924c5f3c219904f41 (patch) | |
| tree | e24573a95986c164ab9c47735adf65c23b9b8500 /libavcodec/wavarc.c | |
| parent | 0ce322a51eae87fd3a0eb96f2280175554ef30c5 (diff) | |
| download | ffmpeg-1a81a40de265df6c5e4e6bb924c5f3c219904f41.tar.gz | |
avcodec/wavarc: Check shift
Fixes: shift exponent 1285 is too large for 32-bit type 'int'
Fixes: 60870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-5332050340347904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/wavarc.c')
| -rw-r--r-- | libavcodec/wavarc.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c index 8e4c7d17dc..0dc5849679 100644 --- a/libavcodec/wavarc.c +++ b/libavcodec/wavarc.c @@ -218,6 +218,10 @@ static int decode_1dif(AVCodecContext *avctx, continue; case 6: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 5: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { @@ -314,6 +318,10 @@ static int decode_2slp(AVCodecContext *avctx, continue; case 7: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 6: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { @@ -586,6 +594,10 @@ static int decode_5elp(AVCodecContext *avctx, continue; case 10: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 9: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { |