On 5/2/20 2:08 PM, Michael Niedermayer wrote: > Fixes: shift exponent 32 is too large for 32-bit type 'int' > Fixes: > 21647/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5686168323883008 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > --- > libavcodec/wavpack.c | 13 ++++++++++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > index 58ab561a15..ead57063c8 100644 > --- a/libavcodec/wavpack.c > +++ b/libavcodec/wavpack.c > @@ -1359,7 +1359,10 @@ static int wavpack_decode_block(AVCodecContext *avctx, > int block_no, > bytestream2_skip(&gb, ssize); > continue; > } > - rate_x = 1 << bytestream2_get_byte(&gb); > + rate_x = bytestream2_get_byte(&gb); > + if (rate_x > 30) > + return AVERROR_INVALIDDATA; > + rate_x = 1 << rate_x; > dsd_mode = bytestream2_get_byte(&gb); > if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) { > av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: > %d\n", > @@ -1498,9 +1501,13 @@ static int wavpack_decode_block(AVCodecContext *avctx, > int block_no, > av_log(avctx, AV_LOG_ERROR, "Custom sample rate missing.\n"); > return AVERROR_INVALIDDATA; > } > - new_samplerate = sample_rate * rate_x; > + new_samplerate = sample_rate; > } else > - new_samplerate = wv_rates[sr] * rate_x; > + new_samplerate = wv_rates[sr]; > + > + if (new_samplerate * (uint64_t)rate_x > INT_MAX) > + return AVERROR_INVALIDDATA; > + new_samplerate *= rate_x; > > if (multiblock) { > if (chan)
Looks correct to me. Thanks. _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
