On Sun, May 03, 2020 at 04:13:47PM -0700, David Bryant wrote: > On 5/2/20 2:08 PM, Michael Niedermayer wrote: > > Fixes: shift exponent 32 is too large for 32-bit type 'int' > > Fixes: > > 21647/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5686168323883008 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > > --- > > libavcodec/wavpack.c | 13 ++++++++++--- > > 1 file changed, 10 insertions(+), 3 deletions(-) > > > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > > index 58ab561a15..ead57063c8 100644 > > --- a/libavcodec/wavpack.c > > +++ b/libavcodec/wavpack.c > > @@ -1359,7 +1359,10 @@ static int wavpack_decode_block(AVCodecContext > > *avctx, int block_no, > > bytestream2_skip(&gb, ssize); > > continue; > > } > > - rate_x = 1 << bytestream2_get_byte(&gb); > > + rate_x = bytestream2_get_byte(&gb); > > + if (rate_x > 30) > > + return AVERROR_INVALIDDATA; > > + rate_x = 1 << rate_x; > > dsd_mode = bytestream2_get_byte(&gb); > > if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) { > > av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: > > %d\n", > > @@ -1498,9 +1501,13 @@ static int wavpack_decode_block(AVCodecContext > > *avctx, int block_no, > > av_log(avctx, AV_LOG_ERROR, "Custom sample rate > > missing.\n"); > > return AVERROR_INVALIDDATA; > > } > > - new_samplerate = sample_rate * rate_x; > > + new_samplerate = sample_rate; > > } else > > - new_samplerate = wv_rates[sr] * rate_x; > > + new_samplerate = wv_rates[sr]; > > + > > + if (new_samplerate * (uint64_t)rate_x > INT_MAX) > > + return AVERROR_INVALIDDATA; > > + new_samplerate *= rate_x; > > > > if (multiblock) { > > if (chan) > > Looks correct to me. Thanks.
will apply thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Freedom in capitalist society always remains about the same as it was in ancient Greek republics: Freedom for slave owners. -- Vladimir Lenin
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
