[FFmpeg-cvslog] avcodec/apac: Sanity check bits_per_coded_sample

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun Dec 18 17:04:27 2022 +0100| [b7d063951d774db5833b7d65162a11dde8bcaeaf] | committer: Michael Niedermayer

avcodec/apac: Sanity check bits_per_coded_sample

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 53931/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APAC_fuzzer-6072913738727424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b7d063951d774db5833b7d65162a11dde8bcaeaf
---

 libavcodec/apac.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavcodec/apac.c b/libavcodec/apac.c
index 030f81adce..3408f75292 100644
--- a/libavcodec/apac.c
+++ b/libavcodec/apac.c
@@ -75,7 +75,10 @@ static av_cold int apac_init(AVCodecContext *avctx)
         avctx->sample_fmt = AV_SAMPLE_FMT_U8P;
 
     if (avctx->ch_layout.nb_channels < 1 ||
-        avctx->ch_layout.nb_channels > 2)
+        avctx->ch_layout.nb_channels > 2 ||
+        avctx->bits_per_coded_sample < 8 ||
+        avctx->bits_per_coded_sample > 16
+    )
         return AVERROR_INVALIDDATA;
 
     for (int ch = 0; ch < avctx->ch_layout.nb_channels; ch++) {