diff mbox

[FFmpeg-devel,2/4] avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check

Message ID 20190616095701.31384-2-michael@niedermayer.cc
State Accepted
Commit 3d4f4f4a15e79c96c3613e5c252b2f5cc4190e18
Headers show

Commit Message

Michael Niedermayer June 16, 2019, 9:56 a.m. UTC 
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/apedec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Michael Niedermayer June 30, 2019, 3:47 p.m. UTC | #1 
On Sun, Jun 16, 2019 at 11:56:59AM +0200, Michael Niedermayer wrote:
> Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
> Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/apedec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

will apply

[...]
diff mbox

Patch

diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c
index 2428c3cb64..3558a5b708 100644
--- a/libavcodec/apedec.c
+++ b/libavcodec/apedec.c
@@ -460,7 +460,7 @@  static inline void update_rice(APERice *rice, unsigned int x)
 
     if (rice->ksum < lim)
         rice->k--;
-    else if (rice->ksum >= (1 << (rice->k + 5)))
+    else if (rice->ksum >= (1 << (rice->k + 5)) && rice->k < 24)
         rice->k++;
 }