[FFmpeg-cvslog] avcodec/proresdec2: SKIP_BITS() does not work with len=32

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon Oct  2 04:18:22 2017 +0200| [c37138e01a93da2f9dd2cc5d4b77e5a38581d130] | committer: Michael Niedermayer

avcodec/proresdec2: SKIP_BITS() does not work with len=32

Fixes: invalid shift
Fixes: 3482/clusterfuzz-testcase-minimized-5446915875405824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c37138e01a93da2f9dd2cc5d4b77e5a38581d130
---

 libavcodec/proresdec2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/proresdec2.c b/libavcodec/proresdec2.c
index e077908027..22dc70eeb4 100644
--- a/libavcodec/proresdec2.c
+++ b/libavcodec/proresdec2.c
@@ -267,7 +267,7 @@ static int decode_picture_header(AVCodecContext *avctx, const uint8_t *buf, cons
                                                                         \
         if (q > switch_bits) { /* exp golomb */                         \
             bits = exp_order - switch_bits + (q<<1);                    \
-            if (bits > MIN_CACHE_BITS)                                  \
+            if (bits > FFMIN(MIN_CACHE_BITS, 31))                       \
                 return AVERROR_INVALIDDATA;                             \
             val = SHOW_UBITS(re, gb, bits) - (1 << exp_order) +         \
                 ((switch_bits + 1) << rice_order);                      \