[FFmpeg-cvslog] avcodec/hevcdec: Check luma/chroma_log2_weight_denom

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sat Feb 17 21:42:34 2018 +0100| [37cd7f3375302b2c8e35946a53db13a8bd123b8b] | 
committer: Michael Niedermayer

avcodec/hevcdec: Check luma/chroma_log2_weight_denom

Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 
'int'
Fixes: 5888/clusterfuzz-testcase-minimized-5634701067812864

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit f82dd4c09b2decb033f1e339d4be81efd38554f1)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=37cd7f3375302b2c8e35946a53db13a8bd123b8b
---

 libavcodec/hevcdec.c | 12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
index 5579a4df43..db0bebfa49 100644
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -149,12 +149,18 @@ static int pred_weight_table(HEVCContext *s, 
GetBitContext *gb)
 int luma_log2_weight_denom;
 
 luma_log2_weight_denom = get_ue_golomb_long(gb);
-if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7)
+if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7) {
 av_log(s->avctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is 
invalid\n", luma_log2_weight_denom);
+return AVERROR_INVALIDDATA;
+}
 s->sh.luma_log2_weight_denom = av_clip_uintp2(luma_log2_weight_denom, 3);
 if (s->ps.sps->chroma_format_idc != 0) {
-int delta = get_se_golomb(gb);
-s->sh.chroma_log2_weight_denom = 
av_clip_uintp2(s->sh.luma_log2_weight_denom + delta, 3);
+int64_t chroma_log2_weight_denom = luma_log2_weight_denom + 
(int64_t)get_se_golomb(gb);
+if (chroma_log2_weight_denom < 0 || chroma_log2_weight_denom > 7) {
+av_log(s->avctx, AV_LOG_ERROR, "chroma_log2_weight_denom %"PRId64" 
is invalid\n", chroma_log2_weight_denom);
+return AVERROR_INVALIDDATA;
+}
+s->sh.chroma_log2_weight_denom = chroma_log2_weight_denom;
 }
 
 for (i = 0; i < s->sh.nb_refs[L0]; i++) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/hevcdec: Check luma/chroma_log2_weight_denom

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer  | Sat 
Feb 17 21:42:34 2018 +0100| [f82dd4c09b2decb033f1e339d4be81efd38554f1] | 
committer: Michael Niedermayer

avcodec/hevcdec: Check luma/chroma_log2_weight_denom

Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 
'int'
Fixes: 5888/clusterfuzz-testcase-minimized-5634701067812864

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f82dd4c09b2decb033f1e339d4be81efd38554f1
---

 libavcodec/hevcdec.c | 12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
index 8f1c1f1953..fc4eb781dc 100644
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -151,12 +151,18 @@ static int pred_weight_table(HEVCContext *s, 
GetBitContext *gb)
 int luma_log2_weight_denom;
 
 luma_log2_weight_denom = get_ue_golomb_long(gb);
-if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7)
+if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7) {
 av_log(s->avctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is 
invalid\n", luma_log2_weight_denom);
+return AVERROR_INVALIDDATA;
+}
 s->sh.luma_log2_weight_denom = av_clip_uintp2(luma_log2_weight_denom, 3);
 if (s->ps.sps->chroma_format_idc != 0) {
-int delta = get_se_golomb(gb);
-s->sh.chroma_log2_weight_denom = 
av_clip_uintp2(s->sh.luma_log2_weight_denom + delta, 3);
+int64_t chroma_log2_weight_denom = luma_log2_weight_denom + 
(int64_t)get_se_golomb(gb);
+if (chroma_log2_weight_denom < 0 || chroma_log2_weight_denom > 7) {
+av_log(s->avctx, AV_LOG_ERROR, "chroma_log2_weight_denom %"PRId64" 
is invalid\n", chroma_log2_weight_denom);
+return AVERROR_INVALIDDATA;
+}
+s->sh.chroma_log2_weight_denom = chroma_log2_weight_denom;
 }
 
 for (i = 0; i < s->sh.nb_refs[L0]; i++) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog