diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-06-17 22:43:22 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-16 18:43:14 +0200 |
| commit | af9935835335cae1ae5a4ec7fc14c1b5e25c1f2d (patch) | |
| tree | c898b3793f86e5a9dedd31edf3d9b1fd42c2a85b /libavcodec | |
| parent | 8ca60e14d2006928220ab7bcc58758ce43532eb2 (diff) | |
| download | ffmpeg-af9935835335cae1ae5a4ec7fc14c1b5e25c1f2d.tar.gz | |
avcodec/vc2enc: Fix overflows with storing large values
Fixes: left shift of 1431634944 by 2 places cannot be represented in type 'int'
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 69061/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-6325700826038272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/vc2enc.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/vc2enc.c b/libavcodec/vc2enc.c index 4ea836d9c9..7fa6ddc4ca 100644 --- a/libavcodec/vc2enc.c +++ b/libavcodec/vc2enc.c @@ -189,7 +189,9 @@ typedef struct VC2EncContext { static av_always_inline void put_vc2_ue_uint(PutBitContext *pb, uint32_t val) { int i; - int pbits = 0, bits = 0, topbit = 1, maxval = 1; + int bits = 0; + unsigned topbit = 1, maxval = 1; + uint64_t pbits = 0; if (!val++) { put_bits(pb, 1, 1); @@ -206,12 +208,13 @@ static av_always_inline void put_vc2_ue_uint(PutBitContext *pb, uint32_t val) for (i = 0; i < bits; i++) { topbit >>= 1; + av_assert2(pbits <= UINT64_MAX>>3); pbits <<= 2; if (val & topbit) pbits |= 0x1; } - put_bits(pb, bits*2 + 1, (pbits << 1) | 1); + put_bits64(pb, bits*2 + 1, (pbits << 1) | 1); } static av_always_inline int count_vc2_ue_uint(uint32_t val) |