diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-04-29 21:19:14 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-15 22:31:13 +0200 |
| commit | e61dcd2c86c4c5367711b522eb47a8ba5a7516e8 (patch) | |
| tree | 32681e8ecbcc412ad499ad5c42d349f929c05d70 /libavcodec | |
| parent | dd3914c5b5f165d734155fe5bcb8c38d864a7c1c (diff) | |
| download | ffmpeg-e61dcd2c86c4c5367711b522eb47a8ba5a7516e8.tar.gz | |
avcodec/mpeg4videodec: Move decode_studiovisualobject() parsing in the branch for visual object parsing
Fixes: runtime error: shift exponent -1 is negative
Fixes: 7510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5024523356209152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e03bf251d8784f4d1df2c22381c902087e151e31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/mpeg4videodec.c | 15 |
1 files changed, 5 insertions, 10 deletions
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c index 32eb3d1ca8..27602e8542 100644 --- a/libavcodec/mpeg4videodec.c +++ b/libavcodec/mpeg4videodec.c @@ -2982,14 +2982,9 @@ static int decode_studio_vop_header(Mpeg4DecContext *ctx, GetBitContext *gb) static int decode_studiovisualobject(Mpeg4DecContext *ctx, GetBitContext *gb) { - uint32_t startcode; MpegEncContext *s = &ctx->m; int visual_object_type, width, height; - startcode = get_bits_long(gb, 32); - - /* StudioVisualObject() */ - if (startcode == VISUAL_OBJ_STARTCODE) { skip_bits(gb, 4); /* visual_object_verid */ visual_object_type = get_bits(gb, 4); @@ -3069,7 +3064,6 @@ static int decode_studiovisualobject(Mpeg4DecContext *ctx, GetBitContext *gb) next_start_code_studio(gb); extension_and_user_data(s, gb, 2); } - } return 0; } @@ -3192,13 +3186,14 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb) s->studio_profile = 1; next_start_code_studio(gb); extension_and_user_data(s, gb, 0); - + } + } else if (startcode == VISUAL_OBJ_STARTCODE) { + if (s->studio_profile) { if ((ret = decode_studiovisualobject(ctx, gb)) < 0) return ret; break; - } - } else if (startcode == VISUAL_OBJ_STARTCODE) { - mpeg4_decode_visual_object(s, gb); + } else + mpeg4_decode_visual_object(s, gb); } else if (startcode == VOP_STARTCODE) { break; } |