diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-02-05 20:41:08 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-02-16 20:10:55 +0100 |
| commit | e816333c55ef3624477a0d6e30fe390864b4dd13 (patch) | |
| tree | 67e88b1d57d3589a078e83407e3cc6d0b5117aaf /libavcodec | |
| parent | 2437e69aec80faa8777bca4a618fbad5e6edb569 (diff) | |
| download | ffmpeg-e816333c55ef3624477a0d6e30fe390864b4dd13.tar.gz | |
avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
Fixes: left shift of 32768 by 16 places cannot be represented in type 'int'
Fixes: Timeout
Fixes: 44219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4679455379947520
Fixes: 44088/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4885976600674304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ee283d7d001cfcfec94a023e172bca731e96514)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/jpeglsdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c index 176300cd2f..1373288adb 100644 --- a/libavcodec/jpeglsdec.c +++ b/libavcodec/jpeglsdec.c @@ -186,7 +186,7 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state, if (RItype) temp += state->N[Q] >> 1; - for (k = 0; (state->N[Q] << k) < temp; k++) + for (k = 0; ((unsigned)state->N[Q] << k) < temp; k++) ; #ifdef JLS_BROKEN |