| Message ID | 20191005214107.20093-4-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | f4ecf6c39de9a7cc1dae70cf87c225771001e883 |
| Headers | show |
On Sat, Oct 05, 2019 at 11:41:05PM +0200, Michael Niedermayer wrote: > Fixes: left shift of negative value -1 > Fixes: 17890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5643307467669504 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/ralf.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) will apply [...]
diff --git a/libavcodec/ralf.c b/libavcodec/ralf.c index 006ab46414..1d881cf7ae 100644 --- a/libavcodec/ralf.c +++ b/libavcodec/ralf.c @@ -234,8 +234,10 @@ static int decode_channel(RALFContext *ctx, GetBitContext *gb, int ch, int *dst = ctx->channel_data[ch]; ctx->filter_params = get_vlc2(gb, set->filter_params.table, 9, 2); - ctx->filter_bits = (ctx->filter_params - 2) >> 6; - ctx->filter_length = ctx->filter_params - (ctx->filter_bits << 6) - 1; + if (ctx->filter_params > 1) { + ctx->filter_bits = (ctx->filter_params - 2) >> 6; + ctx->filter_length = ctx->filter_params - (ctx->filter_bits << 6) - 1; + } if (ctx->filter_params == FILTER_RAW) { for (i = 0; i < length; i++)
Fixes: left shift of negative value -1 Fixes: 17890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5643307467669504 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/ralf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)