[FFmpeg-devel] [PATCH 2/6] avformat/vividas: Fixes overflow in shift in recover_key()

[Michael Niedermayer]

On Sun, Jul 14, 2019 at 09:28:01AM +0200, Reimar Döffinger wrote:
> On 13 July 2019 22:25:02 CEST, Michael Niedermayer <michael at niedermayer.cc> wrote:
> >Fixes: left shift of 133 by 24 places cannot be represented in type
> >'int'
> >Fixes:
> >15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568
> >
> >Found-by: continuous fuzzing process
> >https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> >Suggested-by: Reimar Döffinger <Reimar.Doeffinger at gmx.de>
> >Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> >---
> > libavformat/vividas.c | 5 +----
> > 1 file changed, 1 insertion(+), 4 deletions(-)
> >
> >diff --git a/libavformat/vividas.c b/libavformat/vividas.c
> >index 350c7aa70a..830e318645 100644
> >--- a/libavformat/vividas.c
> >+++ b/libavformat/vividas.c
> >@@ -115,10 +115,7 @@ static unsigned recover_key(unsigned char
> >sample[4], unsigned expected_size)
> > 
> >     put_v(plaintext+2, expected_size);
> > 
> >-    return (sample[0]^plaintext[0])|
> >-        ((sample[1]^plaintext[1])<<8)|
> >-        ((sample[2]^plaintext[2])<<16)|
> >-        ((sample[3]^plaintext[3])<<24);
> >+    return AV_RL32(sample) ^ AV_RL32(plaintext);
> > }
> > 
> >static void xor_block(void *p1, void *p2, unsigned size, int key,
> >unsigned *key_ptr)
> 
> Looks good to me.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Complexity theory is the science of finding the exact solution to an
approximation. Benchmarking OTOH is finding an approximation of the exact
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20190714/8511af37/attachment.sig>