diff mbox

[FFmpeg-devel] avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later

Message ID 20170715230655.344-1-michael@niedermayer.cc
State Accepted
Commit 2886142e0c3b5f4304c6e2a2bd282770a8a47f93
Headers show

Commit Message

Michael Niedermayer July 15, 2017, 11:06 p.m. UTC 
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/aacdec_template.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Michael Niedermayer July 18, 2017, 7:53 p.m. UTC | #1 
On Sun, Jul 16, 2017 at 01:06:55AM +0200, Michael Niedermayer wrote:
> Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
> Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/aacdec_template.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

applied

[...]
diff mbox

Patch

diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c
index c60a6ca096..90cc143781 100644
--- a/libavcodec/aacdec_template.c
+++ b/libavcodec/aacdec_template.c
@@ -2199,6 +2199,10 @@  static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
             cge = coup->coupling_point == AFTER_IMDCT ? 1 : get_bits1(gb);
             gain = cge ? get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60: 0;
             gain_cache = GET_GAIN(scale, gain);
+#if USE_FIXED
+            if ((abs(gain_cache)-1024) >> 3 > 30)
+                return AVERROR(ERANGE);
+#endif
         }
         if (coup->coupling_point == AFTER_IMDCT) {
             coup->gain[c][0] = gain_cache;
@@ -2216,6 +2220,10 @@  static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
                                     t >>= 1;
                                 }
                                 gain_cache = GET_GAIN(scale, t) * s;
+#if USE_FIXED
+                                if ((abs(gain_cache)-1024) >> 3 > 30)
+                                    return AVERROR(ERANGE);
+#endif
                             }
                         }
                         coup->gain[c][idx] = gain_cache;