| Message ID | 20240320025923.3794-2-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 70b26b693e9e06bcd9fe83ee5063ee40e32ce02f |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avcodec/jpeg2000htdec: Check M_b / magp before using it in a shift | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Wed, Mar 20, 2024 at 03:59:21AM +0100, Michael Niedermayer wrote: > Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int' > Fixes: 65909/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-519459745831321 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/vmixdec.c | 3 +++ > 1 file changed, 3 insertions(+) will apply patches 2-4 [...]
diff --git a/libavcodec/vmixdec.c b/libavcodec/vmixdec.c index d6b6e3557f..ab283d13db 100644 --- a/libavcodec/vmixdec.c +++ b/libavcodec/vmixdec.c @@ -235,6 +235,9 @@ static int decode_frame(AVCodecContext *avctx, else if (offset != 3) return AVERROR_INVALIDDATA; + if (s->lshift > 31) + return AVERROR_INVALIDDATA; + q = quality[FFMIN(avpkt->data[offset - 2], FF_ARRAY_ELEMS(quality)-1)]; for (int n = 0; n < 64; n++) s->factors[n] = quant[n] * q;
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int' Fixes: 65909/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-519459745831321 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/vmixdec.c | 3 +++ 1 file changed, 3 insertions(+)