| Message ID | 20191025130218.26463-1-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
On Fri, Oct 25, 2019 at 03:02:16PM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: 2046820356 * 8 cannot be represented in type 'int' > Fixes: 18391/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5631674666188800 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/cook.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) will apply without the " < 0" as that has become unneeded [...]
diff --git a/libavcodec/cook.c b/libavcodec/cook.c index aa11205166..401dbfd33c 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -1075,6 +1075,9 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) return AVERROR_INVALIDDATA; } + if (avctx->block_align >= INT_MAX / 8 || avctx->block_align < 0) + return AVERROR(EINVAL); + /* Initialize RNG. */ av_lfg_init(&q->random_state, 0); @@ -1225,10 +1228,6 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) if ((ret = init_cook_vlc_tables(q))) return ret; - - if (avctx->block_align >= UINT_MAX / 2) - return AVERROR(EINVAL); - /* Pad the databuffer with: DECODE_BYTES_PAD1 or DECODE_BYTES_PAD2 for decode_bytes(), AV_INPUT_BUFFER_PADDING_SIZE, for the bitstreamreader. */
Fixes: signed integer overflow: 2046820356 * 8 cannot be represented in type 'int' Fixes: 18391/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5631674666188800 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/cook.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)