[FFmpeg-devel] [PATCH 3/4] avformat/mxfdec: Check component_depth in mxf_get_color_range()

Tomas Härdin tjoppen at acc.umu.se
Wed Dec 8 01:38:56 EET 2021


lör 2021-12-04 klockan 22:32 +0100 skrev Michael Niedermayer:
> Fixes: shift exponent 4294967163 is too large for 32-bit type 'int'
> Fixes: 41449/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-
> 6183636217495552
> 
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/mxfdec.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> index af9d33f7969..c231c944c01 100644
> --- a/libavformat/mxfdec.c
> +++ b/libavformat/mxfdec.c
> @@ -2274,12 +2274,12 @@ static enum AVColorRange
> mxf_get_color_range(MXFContext *mxf, MXFDescriptor *des
>          /* CDCI range metadata */
>          if (!descriptor->component_depth)
>              return AVCOL_RANGE_UNSPECIFIED;
> -        if (descriptor->black_ref_level == 0 &&
> +        if (descriptor->black_ref_level == 0 && descriptor-
> >component_depth < 31 &&
>              descriptor->white_ref_level == ((1<<descriptor-
> >component_depth) - 1) &&
>              (descriptor->color_range    == (1<<descriptor-
> >component_depth) ||
>               descriptor->color_range    == ((1<<descriptor-
> >component_depth) - 1)))
>              return AVCOL_RANGE_JPEG;
> -        if (descriptor->component_depth >= 8 &&
> +        if (descriptor->component_depth >= 8 && descriptor-
> >component_depth < 31 &&
>              descriptor->black_ref_level == (1  <<(descriptor-
> >component_depth - 4)) &&
>              descriptor->white_ref_level == (235<<(descriptor-
> >component_depth - 8)) &&
>              descriptor->color_range     == ((14<<(descriptor-
> >component_depth - 4)) + 1))

Looks OK

/Tomas



More information about the ffmpeg-devel mailing list