| Message ID | 20170320012150.6470-2-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Headers | show |
On Mon, Mar 20, 2017 at 02:21:50AM +0100, Michael Niedermayer wrote: > Fixes: runtime error: shift exponent 255 is too large for 32-bit type 'unsigned int' > Fixes: 894/clusterfuzz-testcase-4841537823309824 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/wavpack.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > index 3d0b01f257..5086ae442c 100644 > --- a/libavcodec/wavpack.c > +++ b/libavcodec/wavpack.c > @@ -861,6 +861,12 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, > s->and = 1; > s->shift = val[3]; > } > + if (s->shift > 31) { > + av_log(avctx, AV_LOG_ERROR, > + "Invalid INT32INFO, shift = %d (> 32)\n", s->shift); 32 or 31?
On Mon, Mar 20, 2017 at 07:59:04AM +0100, Clément Bœsch wrote: > On Mon, Mar 20, 2017 at 02:21:50AM +0100, Michael Niedermayer wrote: > > Fixes: runtime error: shift exponent 255 is too large for 32-bit type 'unsigned int' > > Fixes: 894/clusterfuzz-testcase-4841537823309824 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/wavpack.c | 6 ++++++ > > 1 file changed, 6 insertions(+) > > > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > > index 3d0b01f257..5086ae442c 100644 > > --- a/libavcodec/wavpack.c > > +++ b/libavcodec/wavpack.c > > @@ -861,6 +861,12 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, > > s->and = 1; > > s->shift = val[3]; > > } > > + if (s->shift > 31) { > > + av_log(avctx, AV_LOG_ERROR, > > + "Invalid INT32INFO, shift = %d (> 32)\n", s->shift); > > 32 or 31? copy and paste error, ill fix it 32 is too big [...]
diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index 3d0b01f257..5086ae442c 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -861,6 +861,12 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, s->and = 1; s->shift = val[3]; } + if (s->shift > 31) { + av_log(avctx, AV_LOG_ERROR, + "Invalid INT32INFO, shift = %d (> 32)\n", s->shift); + s->and = s->or = s->shift = 0; + continue; + } /* original WavPack decoder forces 32-bit lossy sound to be treated * as 24-bit one in order to have proper clipping */ if (s->hybrid && bpp == 4 && s->post_shift < 8 && s->shift > 8) {
Fixes: runtime error: shift exponent 255 is too large for 32-bit type 'unsigned int' Fixes: 894/clusterfuzz-testcase-4841537823309824 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/wavpack.c | 6 ++++++ 1 file changed, 6 insertions(+)