| Message ID | 20190825184158.10244-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 8f49176e845fee8e4e0aaf06411636b46d1ae3ad |
| Headers | show |
On 8/25/2019 3:41 PM, Michael Niedermayer wrote: > Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int' > Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/alac.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/libavcodec/alac.c b/libavcodec/alac.c > index 6086e2caa8..782d461b22 100644 > --- a/libavcodec/alac.c > +++ b/libavcodec/alac.c > @@ -250,10 +250,12 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index, > > alac->extra_bits = get_bits(&alac->gb, 2) << 3; > bps = alac->sample_size - alac->extra_bits + channels - 1; > - if (bps > 32U) { > + if (bps > 32) { > avpriv_report_missing_feature(avctx, "bps %d", bps); > return AVERROR_PATCHWELCOME; > } > + if (bps < 1) > + return AVERROR_INVALIDDATA; > > /* whether the frame is compressed */ > is_compressed = !get_bits1(&alac->gb); LGTM.
On Sun, Aug 25, 2019 at 05:46:10PM -0300, James Almer wrote: > On 8/25/2019 3:41 PM, Michael Niedermayer wrote: > > Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int' > > Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/alac.c | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/libavcodec/alac.c b/libavcodec/alac.c > > index 6086e2caa8..782d461b22 100644 > > --- a/libavcodec/alac.c > > +++ b/libavcodec/alac.c > > @@ -250,10 +250,12 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index, > > > > alac->extra_bits = get_bits(&alac->gb, 2) << 3; > > bps = alac->sample_size - alac->extra_bits + channels - 1; > > - if (bps > 32U) { > > + if (bps > 32) { > > avpriv_report_missing_feature(avctx, "bps %d", bps); > > return AVERROR_PATCHWELCOME; > > } > > + if (bps < 1) > > + return AVERROR_INVALIDDATA; > > > > /* whether the frame is compressed */ > > is_compressed = !get_bits1(&alac->gb); > > LGTM. will apply [...]
diff --git a/libavcodec/alac.c b/libavcodec/alac.c index 6086e2caa8..782d461b22 100644 --- a/libavcodec/alac.c +++ b/libavcodec/alac.c @@ -250,10 +250,12 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index, alac->extra_bits = get_bits(&alac->gb, 2) << 3; bps = alac->sample_size - alac->extra_bits + channels - 1; - if (bps > 32U) { + if (bps > 32) { avpriv_report_missing_feature(avctx, "bps %d", bps); return AVERROR_PATCHWELCOME; } + if (bps < 1) + return AVERROR_INVALIDDATA; /* whether the frame is compressed */ is_compressed = !get_bits1(&alac->gb);
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int' Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/alac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)