@@ -1313,16 +1313,17 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb)
break;
}
- if (v->fcm != PROGRESSIVE && !v->s.quarter_sample) {
- v->range_x <<= 1;
- v->range_y <<= 1;
- }
/* AC Syntax */
v->c_ac_table_index = decode012(gb);
if (v->s.pict_type == AV_PICTURE_TYPE_I || v->s.pict_type == AV_PICTURE_TYPE_BI) {
v->y_ac_table_index = decode012(gb);
}
+ else if (v->fcm != PROGRESSIVE && !v->s.quarter_sample) {
+ v->range_x <<= 1;
+ v->range_y <<= 1;
+ }
+
/* DC Syntax */
v->s.dc_table_index = get_bits1(gb);
if ((v->s.pict_type == AV_PICTURE_TYPE_I || v->s.pict_type == AV_PICTURE_TYPE_BI)
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int' Fixes: 16976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4847262047404032 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/vc1.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)