[FFmpeg-devel] [PATCH 1/2] avcodec/dirac_vlc: Fix invalid shift

[Michael Niedermayer]

On Fri, Jul 28, 2017 at 08:50:42PM +0200, Michael Niedermayer wrote:
> On Fri, Jul 28, 2017 at 02:44:34AM +0100, Rostislav Pehlivanov wrote:
> > On 28 July 2017 at 02:22, Michael Niedermayer <michael at niedermayer.cc>
> > wrote:
> > 
> > > Fixes: runtime error: shift exponent 65 is too large for 64-bit type
> > > 'residual' (aka 'unsigned long')
> > > Fixes: 2737/clusterfuzz-testcase-minimized-4968639147016192
> > >
> > > Found-by: continuous fuzzing process https://github.com/google/oss-
> > > fuzz/tree/master/projects/ffmpeg
> > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > ---
> > >  libavcodec/dirac_vlc.c | 3 +++
> > >  1 file changed, 3 insertions(+)
> > >
> > > diff --git a/libavcodec/dirac_vlc.c b/libavcodec/dirac_vlc.c
> > > index 773f720858..f9a6017ec0 100644
> > > --- a/libavcodec/dirac_vlc.c
> > > +++ b/libavcodec/dirac_vlc.c
> > > @@ -96,6 +96,9 @@ int ff_dirac_golomb_read_16bit(DiracGolombLUT *lut_ctx,
> > > const uint8_t *buf,
> > >          if ((c_idx + 1) > coeffs)
> > >              return c_idx;
> > >
> > > +        if (res_bits >= RSIZE_BITS)
> > > +            return 0;
> > > +
> > >          if (res_bits && l->sign) {
> > >              int32_t coeff = 1;
> > >              APPEND_RESIDUE(res, l->preamble);
> > > --
> > > 2.13.0
> > >
> > > _______________________________________________
> > > ffmpeg-devel mailing list
> > > ffmpeg-devel at ffmpeg.org
> > > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> > >
> > 
> > Empty the residue instead of giving up. That's the better solution I think.
> 
> you mean "res_bits = res = 0;" ?
> 
> if so ill push that

applied

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Let us carefully observe those good qualities wherein our enemies excel us
and endeavor to excel them, by avoiding what is faulty, and imitating what
is excellent in them. -- Plutarch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170801/084eee50/attachment.sig>