MrBesen
/
ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/hevcdec: do basic validity check on delta_chroma_weight and offset 

Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 2385/clusterfuzz-testcase-minimized-6594333576790016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-06-27 14:11:00 +02:00
parent 35a5d9715d
commit 2c874548d6
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libavcodec/hevcdec.c
View File

@ -139,7 +139,7 @@ fail:
return AVERROR(ENOMEM);
}
static void pred_weight_table(HEVCContext *s, GetBitContext *gb)
static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
{
int i = 0;
int j = 0;
@ -182,6 +182,12 @@ static void pred_weight_table(HEVCContext *s, GetBitContext *gb)
for (j = 0; j < 2; j++) {
int delta_chroma_weight_l0 = get_se_golomb(gb);
int delta_chroma_offset_l0 = get_se_golomb(gb);
if ( (int8_t)delta_chroma_weight_l0 != delta_chroma_weight_l0
|| delta_chroma_offset_l0 < -(1<<17) || delta_chroma_offset_l0 > (1<<17)) {
return AVERROR_INVALIDDATA;
}
s->sh.chroma_weight_l0[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l0;
s->sh.chroma_offset_l0[i][j] = av_clip((delta_chroma_offset_l0 - ((128 * s->sh.chroma_weight_l0[i][j])
>> s->sh.chroma_log2_weight_denom) + 128), -128, 127);
@ -218,6 +224,12 @@ static void pred_weight_table(HEVCContext *s, GetBitContext *gb)
for (j = 0; j < 2; j++) {
int delta_chroma_weight_l1 = get_se_golomb(gb);
int delta_chroma_offset_l1 = get_se_golomb(gb);
if ( (int8_t)delta_chroma_weight_l1 != delta_chroma_weight_l1
|| delta_chroma_offset_l1 < -(1<<17) || delta_chroma_offset_l1 > (1<<17)) {
return AVERROR_INVALIDDATA;
}
s->sh.chroma_weight_l1[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l1;
s->sh.chroma_offset_l1[i][j] = av_clip((delta_chroma_offset_l1 - ((128 * s->sh.chroma_weight_l1[i][j])
>> s->sh.chroma_log2_weight_denom) + 128), -128, 127);
@ -230,6 +242,7 @@ static void pred_weight_table(HEVCContext *s, GetBitContext *gb)
}
}
}
return 0;
}
static int decode_lt_rps(HEVCContext *s, LongTermRPS *rps, GetBitContext *gb)
@ -692,7 +705,9 @@ static int hls_slice_header(HEVCContext *s)
if ((s->ps.pps->weighted_pred_flag && sh->slice_type == HEVC_SLICE_P) ||
(s->ps.pps->weighted_bipred_flag && sh->slice_type == HEVC_SLICE_B)) {
pred_weight_table(s, gb);
int ret = pred_weight_table(s, gb);
if (ret < 0)
return ret;
}
sh->max_num_merge_cand = 5 - get_ue_golomb_long(gb);