[FFmpeg-cvslog] avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Mon Jan 15 23:46:44 2018 +0100| [aec30d0da9dc66de0d05b0c9d65022611bbf3f9b] | 
committer: Michael Niedermayer

avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in 
coeff_abs_level_remaining_decode()

I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.

Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented 
in type 'int'

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit a026a3efaeb9c2026668dccbbda339a21ab3206b)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=aec30d0da9dc66de0d05b0c9d65022611bbf3f9b
---

 libavcodec/hevc_cabac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/hevc_cabac.c b/libavcodec/hevc_cabac.c
index 5e46c59a24..29485dc64c 100644
--- a/libavcodec/hevc_cabac.c
+++ b/libavcodec/hevc_cabac.c
@@ -987,7 +987,7 @@ static av_always_inline int 
coeff_abs_level_remaining_decode(HEVCContext *s, int
 } else {
 int prefix_minus3 = prefix - 3;
 
-if (prefix == CABAC_MAX_BIN) {
+if (prefix == CABAC_MAX_BIN || prefix_minus3 + rc_rice_param >= 31) {
 av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
 return 0;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()

[Michael Niedermayer]

ffmpeg | branch: release/3.0 | Michael Niedermayer  | 
Mon Jan 15 23:46:44 2018 +0100| [cedd9ea93ea2f71a57e3b1e9fa01bd7b0cf02bba] | 
committer: Michael Niedermayer

avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in 
coeff_abs_level_remaining_decode()

I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.

Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented 
in type 'int'

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit a026a3efaeb9c2026668dccbbda339a21ab3206b)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cedd9ea93ea2f71a57e3b1e9fa01bd7b0cf02bba
---

 libavcodec/hevc_cabac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/hevc_cabac.c b/libavcodec/hevc_cabac.c
index c9525596bc..0e4c522bb1 100644
--- a/libavcodec/hevc_cabac.c
+++ b/libavcodec/hevc_cabac.c
@@ -985,7 +985,7 @@ static av_always_inline int 
coeff_abs_level_remaining_decode(HEVCContext *s, int
 } else {
 int prefix_minus3 = prefix - 3;
 
-if (prefix == CABAC_MAX_BIN) {
+if (prefix == CABAC_MAX_BIN || prefix_minus3 + rc_rice_param >= 31) {
 av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
 return 0;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Mon Jan 15 23:46:44 2018 +0100| [c740f585a183abccd0ffc9cce67989b4bb0d08b9] | 
committer: Michael Niedermayer

avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in 
coeff_abs_level_remaining_decode()

I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.

Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented 
in type 'int'

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit a026a3efaeb9c2026668dccbbda339a21ab3206b)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c740f585a183abccd0ffc9cce67989b4bb0d08b9
---

 libavcodec/hevc_cabac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/hevc_cabac.c b/libavcodec/hevc_cabac.c
index c9525596bc..0e4c522bb1 100644
--- a/libavcodec/hevc_cabac.c
+++ b/libavcodec/hevc_cabac.c
@@ -985,7 +985,7 @@ static av_always_inline int 
coeff_abs_level_remaining_decode(HEVCContext *s, int
 } else {
 int prefix_minus3 = prefix - 3;
 
-if (prefix == CABAC_MAX_BIN) {
+if (prefix == CABAC_MAX_BIN || prefix_minus3 + rc_rice_param >= 31) {
 av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
 return 0;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()

[Michael Niedermayer]

ffmpeg | branch: release/3.4 | Michael Niedermayer  | 
Mon Jan 15 23:46:44 2018 +0100| [11498c22a0db9ed08027405e5d6a4ba7c1e41418] | 
committer: Michael Niedermayer

avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in 
coeff_abs_level_remaining_decode()

I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.

Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented 
in type 'int'

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit a026a3efaeb9c2026668dccbbda339a21ab3206b)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=11498c22a0db9ed08027405e5d6a4ba7c1e41418
---

 libavcodec/hevc_cabac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/hevc_cabac.c b/libavcodec/hevc_cabac.c
index 743168500c..faa36d5459 100644
--- a/libavcodec/hevc_cabac.c
+++ b/libavcodec/hevc_cabac.c
@@ -998,7 +998,7 @@ static av_always_inline int 
coeff_abs_level_remaining_decode(HEVCContext *s, int
 } else {
 int prefix_minus3 = prefix - 3;
 
-if (prefix == CABAC_MAX_BIN) {
+if (prefix == CABAC_MAX_BIN || prefix_minus3 + rc_rice_param >= 31) {
 av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
 return 0;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer  | Mon 
Jan 15 23:46:44 2018 +0100| [a026a3efaeb9c2026668dccbbda339a21ab3206b] | 
committer: Michael Niedermayer

avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in 
coeff_abs_level_remaining_decode()

I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.

Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented 
in type 'int'

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a026a3efaeb9c2026668dccbbda339a21ab3206b
---

 libavcodec/hevc_cabac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/hevc_cabac.c b/libavcodec/hevc_cabac.c
index 743168500c..faa36d5459 100644
--- a/libavcodec/hevc_cabac.c
+++ b/libavcodec/hevc_cabac.c
@@ -998,7 +998,7 @@ static av_always_inline int 
coeff_abs_level_remaining_decode(HEVCContext *s, int
 } else {
 int prefix_minus3 = prefix - 3;
 
-if (prefix == CABAC_MAX_BIN) {
+if (prefix == CABAC_MAX_BIN || prefix_minus3 + rc_rice_param >= 31) {
 av_log(s->avctx, AV_LOG_ERROR, "CABAC_MAX_BIN : %d\n", prefix);
 return 0;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog