Message ID | 20190829190459.5171-1-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | 9fac243744c6c0ce2a2cf23550bc48b736661379 |
Headers | show |
On Thu, Aug 29, 2019 at 09:04:58PM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: 57342 * 120830 cannot be represented in type 'int' > Fixes: 16426/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5758744817827840 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > --- > libavcodec/cfhd.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) will apply [...]
diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 27eed415d1..b4d6b25cbc 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -625,8 +625,12 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, ret = ff_set_dimensions(avctx, s->coded_width, s->coded_height); if (ret < 0) return ret; - if (s->cropped_height) - avctx->height = s->cropped_height << (avctx->pix_fmt == AV_PIX_FMT_BAYER_RGGB16); + if (s->cropped_height) { + unsigned height = s->cropped_height << (avctx->pix_fmt == AV_PIX_FMT_BAYER_RGGB16); + if (avctx->height < height) + return AVERROR_INVALIDDATA; + avctx->height = height; + } frame.f->width = frame.f->height = 0;