ffmpeg | branch: master | Michael Niedermayer <mich...@niedermayer.cc> | Thu May 11 18:39:33 2017 +0200| [2bfd0a97587d26c0c39413a6291ccc66e4a928d0] | committer: Michael Niedermayer
avcodec/cllc: Check num_bits Fixes: runtime error: shift exponent -2 is negative Fixes: 1479/clusterfuzz-testcase-minimized-6638493360979968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2bfd0a97587d26c0c39413a6291ccc66e4a928d0 --- libavcodec/cllc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/cllc.c b/libavcodec/cllc.c index b53e2c539c..933144ae81 100644 --- a/libavcodec/cllc.c +++ b/libavcodec/cllc.c @@ -56,6 +56,13 @@ static int read_code_table(CLLCContext *ctx, GetBitContext *gb, VLC *vlc) num_lens = get_bits(gb, 5); + if (num_lens > VLC_BITS * VLC_DEPTH) { + vlc->table = NULL; + + av_log(ctx->avctx, AV_LOG_ERROR, "To long VLCs %d\n", num_lens); + return AVERROR_INVALIDDATA; + } + for (i = 0; i < num_lens; i++) { num_codes = get_bits(gb, 9); num_codes_sum += num_codes; _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
