MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/hevcdec: Check luma/chroma_log2_weight_denom

Browse Source 
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'
Fixes: 5888/clusterfuzz-testcase-minimized-5634701067812864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-02-17 21:42:34 +01:00
parent d2fc244293
commit f82dd4c09b
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/hevcdec.c
View File

@ -151,12 +151,18 @@ static int pred_weight_table(HEVCContext *s, GetBitContext *gb)
int luma_log2_weight_denom;
luma_log2_weight_denom = get_ue_golomb_long(gb);
if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7)
if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7) {
av_log(s->avctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is invalid\n", luma_log2_weight_denom);
return AVERROR_INVALIDDATA;
}
s->sh.luma_log2_weight_denom = av_clip_uintp2(luma_log2_weight_denom, 3);
if (s->ps.sps->chroma_format_idc != 0) {
int delta = get_se_golomb(gb);
s->sh.chroma_log2_weight_denom = av_clip_uintp2(s->sh.luma_log2_weight_denom + delta, 3);
int64_t chroma_log2_weight_denom = luma_log2_weight_denom + (int64_t)get_se_golomb(gb);
if (chroma_log2_weight_denom < 0 || chroma_log2_weight_denom > 7) {
av_log(s->avctx, AV_LOG_ERROR, "chroma_log2_weight_denom %"PRId64" is invalid\n", chroma_log2_weight_denom);
return AVERROR_INVALIDDATA;
}
s->sh.chroma_log2_weight_denom = chroma_log2_weight_denom;
}
for (i = 0; i < s->sh.nb_refs[L0]; i++) {