On Fri, Sep 11, 2020 at 11:12:33AM +0200, Paul B Mahol wrote: > On Fri, Sep 11, 2020 at 01:19:59AM +0200, Michael Niedermayer wrote: > > Fixes: index -1 out of bounds for type 'const uint8_t [6][16]' > > Fixes: out of array read > > Fixes: shift exponent -21 is negative > > Fixes: > > 25422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5748258226569216 > > Fixes: shift exponent 8039082 is too large for 32-bit type 'int' > > Fixes: > > 25430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5698567770210304 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > > --- > > libavcodec/mobiclip.c | 6 +++++- > > 1 file changed, 5 insertions(+), 1 deletion(-) > > > > diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c > > index d147eddbae..13f0edc89d 100644 > > --- a/libavcodec/mobiclip.c > > +++ b/libavcodec/mobiclip.c > > @@ -1323,6 +1323,10 @@ static int mobiclip_decode(AVCodecContext *avctx, > > void *data, > > } > > } else { > > MotionXY *motion = s->motion; > > + int quantizer = s->quantizer + get_se_golomb(gb); > > + > > + if (quantizer < 12 || quantizer > 161) > > From where this numbers come?
It comes from the implementation qtab is int and will overflow beyond 161 and below 12 the shift will be negative here: s->qtab[1][i] = quant8x8_tab[qx][i] << (qy - 2); > I think this is too aggressive. [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Many that live deserve death. And some that die deserve life. Can you give it to them? Then do not be too eager to deal out death in judgement. For even the very wise cannot see all ends. -- Gandalf
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
