Fixes: shift exponent 1285 is too large for 32-bit type 'int' Fixes: 60870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-5332050340347904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/wavarc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c index 8e4c7d17dc..0dc5849679 100644 --- a/libavcodec/wavarc.c +++ b/libavcodec/wavarc.c @@ -218,6 +218,10 @@ static int decode_1dif(AVCodecContext *avctx, continue; case 6: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 5: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { @@ -314,6 +318,10 @@ static int decode_2slp(AVCodecContext *avctx, continue; case 7: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 6: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { @@ -586,6 +594,10 @@ static int decode_5elp(AVCodecContext *avctx, continue; case 10: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 9: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { -- 2.17.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
