[FFmpeg-devel] avcodec/ac3dec: Fix shift signedness in mask creation

Submitted by Michael Niedermayer on Sept. 21, 2018, 12:30 p.m.

Details

Message ID 20180921123053.28534-1-michael@niedermayer.cc
State New
Headers show

Commit Message

Michael Niedermayer Sept. 21, 2018, 12:30 p.m.
Fixes: 9924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EAC3_fuzzer-5473421772193792
Fixes: left shift of 1 by 63 places cannot be represented in type 'long long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/ac3dec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

James Almer Sept. 21, 2018, 1:41 p.m.
On 9/21/2018 9:30 AM, Michael Niedermayer wrote:
> Fixes: 9924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EAC3_fuzzer-5473421772193792
> Fixes: left shift of 1 by 63 places cannot be represented in type 'long long'
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/ac3dec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c
> index eed8ce5b39..e4d293a2aa 100644
> --- a/libavcodec/ac3dec.c
> +++ b/libavcodec/ac3dec.c
> @@ -1708,7 +1708,7 @@ dependent_frame:
>                      int i;
>  
>                      for (i = 0; i < 64; i++) {
> -                        if ((1LL << i) & ff_eac3_custom_channel_map_locations[ch][1]) {
> +                        if ((1ULL << i) & ff_eac3_custom_channel_map_locations[ch][1]) {
>                              int index = av_get_channel_layout_channel_index(channel_layout,
>                                                                              1LL << i);

What about this one?

>                              if (index < 0)
>
Michael Niedermayer Sept. 21, 2018, 7:30 p.m.
On Fri, Sep 21, 2018 at 10:41:18AM -0300, James Almer wrote:
> On 9/21/2018 9:30 AM, Michael Niedermayer wrote:
> > Fixes: 9924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EAC3_fuzzer-5473421772193792
> > Fixes: left shift of 1 by 63 places cannot be represented in type 'long long'
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/ac3dec.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c
> > index eed8ce5b39..e4d293a2aa 100644
> > --- a/libavcodec/ac3dec.c
> > +++ b/libavcodec/ac3dec.c
> > @@ -1708,7 +1708,7 @@ dependent_frame:
> >                      int i;
> >  
> >                      for (i = 0; i < 64; i++) {
> > -                        if ((1LL << i) & ff_eac3_custom_channel_map_locations[ch][1]) {
> > +                        if ((1ULL << i) & ff_eac3_custom_channel_map_locations[ch][1]) {
> >                              int index = av_get_channel_layout_channel_index(channel_layout,
> >                                                                              1LL << i);
> 
> What about this one?

i think the code is never reached with i==63, but i agree the 2nd one should
be changed too if one is changed, its cleaner and more consistent. i will do 
that

thx

[...]
Michael Niedermayer Sept. 21, 2018, 11:06 p.m.
On Fri, Sep 21, 2018 at 09:30:36PM +0200, Michael Niedermayer wrote:
> On Fri, Sep 21, 2018 at 10:41:18AM -0300, James Almer wrote:
> > On 9/21/2018 9:30 AM, Michael Niedermayer wrote:
> > > Fixes: 9924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EAC3_fuzzer-5473421772193792
> > > Fixes: left shift of 1 by 63 places cannot be represented in type 'long long'
> > > 
> > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > > ---
> > >  libavcodec/ac3dec.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c
> > > index eed8ce5b39..e4d293a2aa 100644
> > > --- a/libavcodec/ac3dec.c
> > > +++ b/libavcodec/ac3dec.c
> > > @@ -1708,7 +1708,7 @@ dependent_frame:
> > >                      int i;
> > >  
> > >                      for (i = 0; i < 64; i++) {
> > > -                        if ((1LL << i) & ff_eac3_custom_channel_map_locations[ch][1]) {
> > > +                        if ((1ULL << i) & ff_eac3_custom_channel_map_locations[ch][1]) {
> > >                              int index = av_get_channel_layout_channel_index(channel_layout,
> > >                                                                              1LL << i);
> > 
> > What about this one?
> 
> i think the code is never reached with i==63, but i agree the 2nd one should
> be changed too if one is changed, its cleaner and more consistent. i will do 
> that

will apply with this change

thx

[...]

Patch hide | download patch | download mbox

diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c
index eed8ce5b39..e4d293a2aa 100644
--- a/libavcodec/ac3dec.c
+++ b/libavcodec/ac3dec.c
@@ -1708,7 +1708,7 @@  dependent_frame:
                     int i;
 
                     for (i = 0; i < 64; i++) {
-                        if ((1LL << i) & ff_eac3_custom_channel_map_locations[ch][1]) {
+                        if ((1ULL << i) & ff_eac3_custom_channel_map_locations[ch][1]) {
                             int index = av_get_channel_layout_channel_index(channel_layout,
                                                                             1LL << i);
                             if (index < 0)