diff mbox

[FFmpeg-devel,2/3] avcodec/hevcdec: Check luma/chroma_log2_weight_denom

Message ID 20180217212512.18487-2-michael@niedermayer.cc
State Accepted
Commit f82dd4c09b2decb033f1e339d4be81efd38554f1
Headers show

Commit Message

Michael Niedermayer Feb. 17, 2018, 9:25 p.m. UTC 
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'
Fixes: 5888/clusterfuzz-testcase-minimized-5634701067812864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/hevcdec.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

Comments

Michael Niedermayer Feb. 18, 2018, 10:25 p.m. UTC | #1 
On Sat, Feb 17, 2018 at 10:25:11PM +0100, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'
> Fixes: 5888/clusterfuzz-testcase-minimized-5634701067812864
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/hevcdec.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)

will apply

[...]
diff mbox

Patch

diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
index 8f1c1f1953..fc4eb781dc 100644
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -151,12 +151,18 @@  static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
     int luma_log2_weight_denom;
 
     luma_log2_weight_denom = get_ue_golomb_long(gb);
-    if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7)
+    if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7) {
         av_log(s->avctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is invalid\n", luma_log2_weight_denom);
+        return AVERROR_INVALIDDATA;
+    }
     s->sh.luma_log2_weight_denom = av_clip_uintp2(luma_log2_weight_denom, 3);
     if (s->ps.sps->chroma_format_idc != 0) {
-        int delta = get_se_golomb(gb);
-        s->sh.chroma_log2_weight_denom = av_clip_uintp2(s->sh.luma_log2_weight_denom + delta, 3);
+        int64_t chroma_log2_weight_denom = luma_log2_weight_denom + (int64_t)get_se_golomb(gb);
+        if (chroma_log2_weight_denom < 0 || chroma_log2_weight_denom > 7) {
+            av_log(s->avctx, AV_LOG_ERROR, "chroma_log2_weight_denom %"PRId64" is invalid\n", chroma_log2_weight_denom);
+            return AVERROR_INVALIDDATA;
+        }
+        s->sh.chroma_log2_weight_denom = chroma_log2_weight_denom;
     }
 
     for (i = 0; i < s->sh.nb_refs[L0]; i++) {