[FFmpeg-cvslog] avcodec/snowdec: Fix integer overflow before htaps check

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Mon Jan 15 03:03:36 2018 +0100| [60bc7a6ec08a662c02e10eb1660d15e2a65ff0f5] | 
committer: Michael Niedermayer

avcodec/snowdec: Fix integer overflow before htaps check

Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be 
represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 2eecf3cf8eeae67697934df326e98df2149881e5)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=60bc7a6ec08a662c02e10eb1660d15e2a65ff0f5
---

 libavcodec/snowdec.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
index df425b8cf3..00fa064102 100644
--- a/libavcodec/snowdec.c
+++ b/libavcodec/snowdec.c
@@ -363,9 +363,10 @@ static int decode_header(SnowContext *s){
 int htaps, i, sum=0;
 Plane *p= >plane[plane_index];
 p->diag_mc= get_rac(>c, s->header_state);
-htaps= get_symbol(>c, s->header_state, 0)*2 + 2;
-if((unsigned)htaps >= HTAPS_MAX || htaps==0)
+htaps= get_symbol(>c, s->header_state, 0);
+if((unsigned)htaps >= HTAPS_MAX/2 - 1)
 return AVERROR_INVALIDDATA;
+htaps = htaps*2 + 2;
 p->htaps= htaps;
 for(i= htaps/2; i; i--){
 p->hcoeff[i]= get_symbol(>c, s->header_state, 0) * 
(1-2*(i&1));

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/snowdec: Fix integer overflow before htaps check

[Michael Niedermayer]

ffmpeg | branch: release/3.0 | Michael Niedermayer  | 
Mon Jan 15 03:03:36 2018 +0100| [dfb84488428bae5fe3aacecdb06f934c607a7e44] | 
committer: Michael Niedermayer

avcodec/snowdec: Fix integer overflow before htaps check

Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be 
represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 2eecf3cf8eeae67697934df326e98df2149881e5)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dfb84488428bae5fe3aacecdb06f934c607a7e44
---

 libavcodec/snowdec.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
index df425b8cf3..00fa064102 100644
--- a/libavcodec/snowdec.c
+++ b/libavcodec/snowdec.c
@@ -363,9 +363,10 @@ static int decode_header(SnowContext *s){
 int htaps, i, sum=0;
 Plane *p= >plane[plane_index];
 p->diag_mc= get_rac(>c, s->header_state);
-htaps= get_symbol(>c, s->header_state, 0)*2 + 2;
-if((unsigned)htaps >= HTAPS_MAX || htaps==0)
+htaps= get_symbol(>c, s->header_state, 0);
+if((unsigned)htaps >= HTAPS_MAX/2 - 1)
 return AVERROR_INVALIDDATA;
+htaps = htaps*2 + 2;
 p->htaps= htaps;
 for(i= htaps/2; i; i--){
 p->hcoeff[i]= get_symbol(>c, s->header_state, 0) * 
(1-2*(i&1));

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/snowdec: Fix integer overflow before htaps check

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Mon Jan 15 03:03:36 2018 +0100| [b9948d52756a883afb1e7cebf9740f1094e1f3f3] | 
committer: Michael Niedermayer

avcodec/snowdec: Fix integer overflow before htaps check

Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be 
represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 2eecf3cf8eeae67697934df326e98df2149881e5)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b9948d52756a883afb1e7cebf9740f1094e1f3f3
---

 libavcodec/snowdec.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
index 4506c9b815..fc917e0c35 100644
--- a/libavcodec/snowdec.c
+++ b/libavcodec/snowdec.c
@@ -360,9 +360,10 @@ static int decode_header(SnowContext *s){
 int htaps, i, sum=0;
 Plane *p= >plane[plane_index];
 p->diag_mc= get_rac(>c, s->header_state);
-htaps= get_symbol(>c, s->header_state, 0)*2 + 2;
-if((unsigned)htaps >= HTAPS_MAX || htaps==0)
+htaps= get_symbol(>c, s->header_state, 0);
+if((unsigned)htaps >= HTAPS_MAX/2 - 1)
 return AVERROR_INVALIDDATA;
+htaps = htaps*2 + 2;
 p->htaps= htaps;
 for(i= htaps/2; i; i--){
 p->hcoeff[i]= get_symbol(>c, s->header_state, 0) * 
(1-2*(i&1));

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/snowdec: Fix integer overflow before htaps check

[Michael Niedermayer]

ffmpeg | branch: release/3.4 | Michael Niedermayer  | 
Mon Jan 15 03:03:36 2018 +0100| [aed915b8a62cd7be2a8eb5261cc29df824f8d874] | 
committer: Michael Niedermayer

avcodec/snowdec: Fix integer overflow before htaps check

Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be 
represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 2eecf3cf8eeae67697934df326e98df2149881e5)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=aed915b8a62cd7be2a8eb5261cc29df824f8d874
---

 libavcodec/snowdec.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
index a9bdb8da5e..0146a2a4c9 100644
--- a/libavcodec/snowdec.c
+++ b/libavcodec/snowdec.c
@@ -363,9 +363,10 @@ static int decode_header(SnowContext *s){
 int htaps, i, sum=0;
 Plane *p= >plane[plane_index];
 p->diag_mc= get_rac(>c, s->header_state);
-htaps= get_symbol(>c, s->header_state, 0)*2 + 2;
-if((unsigned)htaps >= HTAPS_MAX || htaps==0)
+htaps= get_symbol(>c, s->header_state, 0);
+if((unsigned)htaps >= HTAPS_MAX/2 - 1)
 return AVERROR_INVALIDDATA;
+htaps = htaps*2 + 2;
 p->htaps= htaps;
 for(i= htaps/2; i; i--){
 p->hcoeff[i]= get_symbol(>c, s->header_state, 0) * 
(1-2*(i&1));

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/snowdec: Fix integer overflow before htaps check

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer  | Mon 
Jan 15 03:03:36 2018 +0100| [2eecf3cf8eeae67697934df326e98df2149881e5] | 
committer: Michael Niedermayer

avcodec/snowdec: Fix integer overflow before htaps check

Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be 
represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2eecf3cf8eeae67697934df326e98df2149881e5
---

 libavcodec/snowdec.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
index a9bdb8da5e..0146a2a4c9 100644
--- a/libavcodec/snowdec.c
+++ b/libavcodec/snowdec.c
@@ -363,9 +363,10 @@ static int decode_header(SnowContext *s){
 int htaps, i, sum=0;
 Plane *p= >plane[plane_index];
 p->diag_mc= get_rac(>c, s->header_state);
-htaps= get_symbol(>c, s->header_state, 0)*2 + 2;
-if((unsigned)htaps >= HTAPS_MAX || htaps==0)
+htaps= get_symbol(>c, s->header_state, 0);
+if((unsigned)htaps >= HTAPS_MAX/2 - 1)
 return AVERROR_INVALIDDATA;
+htaps = htaps*2 + 2;
 p->htaps= htaps;
 for(i= htaps/2; i; i--){
 p->hcoeff[i]= get_symbol(>c, s->header_state, 0) * 
(1-2*(i&1));

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog