| Message ID | 20200618124122.23211-1-andreas.rheinhardt@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [FFmpeg-devel] avcodec/cbs_av1: Use unsigned to avoid undefined shift | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
On 6/18/2020 9:41 AM, Andreas Rheinhardt wrote: > Fixes: assertion failure > Fixes: left shift of 1 by 31 places cannot be represented in type 'int' > Fixes: 23264/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_METADATA_fuzzer-6308429248593920 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> > --- > libavcodec/cbs_av1.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c > index 29b316e011..7af63e2165 100644 > --- a/libavcodec/cbs_av1.c > +++ b/libavcodec/cbs_av1.c > @@ -125,7 +125,7 @@ static int cbs_av1_write_uvlc(CodedBitstreamContext *ctx, PutBitContext *pbc, > put_bits(pbc, 1, 1); > } else { > zeroes = av_log2(value + 1); > - v = value - (1 << zeroes) + 1; > + v = value - (1U << zeroes) + 1; > put_bits(pbc, zeroes + 1, 1); > put_bits(pbc, zeroes, v); > } LGTM.
On Thu, Jun 18, 2020 at 02:41:22PM +0200, Andreas Rheinhardt wrote: > Fixes: assertion failure > Fixes: left shift of 1 by 31 places cannot be represented in type 'int' > Fixes: 23264/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_METADATA_fuzzer-6308429248593920 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> > --- > libavcodec/cbs_av1.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c > index 29b316e011..7af63e2165 100644 > --- a/libavcodec/cbs_av1.c > +++ b/libavcodec/cbs_av1.c > @@ -125,7 +125,7 @@ static int cbs_av1_write_uvlc(CodedBitstreamContext *ctx, PutBitContext *pbc, > put_bits(pbc, 1, 1); > } else { > zeroes = av_log2(value + 1); > - v = value - (1 << zeroes) + 1; > + v = value - (1U << zeroes) + 1; > put_bits(pbc, zeroes + 1, 1); thats not valid, the put bits wont handle that but as i see another patchset following later, i guess that has been noticed already thx [...]
diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c index 29b316e011..7af63e2165 100644 --- a/libavcodec/cbs_av1.c +++ b/libavcodec/cbs_av1.c @@ -125,7 +125,7 @@ static int cbs_av1_write_uvlc(CodedBitstreamContext *ctx, PutBitContext *pbc, put_bits(pbc, 1, 1); } else { zeroes = av_log2(value + 1); - v = value - (1 << zeroes) + 1; + v = value - (1U << zeroes) + 1; put_bits(pbc, zeroes + 1, 1); put_bits(pbc, zeroes, v); }
Fixes: assertion failure Fixes: left shift of 1 by 31 places cannot be represented in type 'int' Fixes: 23264/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_METADATA_fuzzer-6308429248593920 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> --- libavcodec/cbs_av1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)